x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000068", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:09 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200220019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 483.524433][T13762] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:09 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x77359400}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x3938700}}, &(0x7f0000000140)) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) madvise(&(0x7f0000490000/0x1000)=nil, 0x1000, 0x2) 00:01:09 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000080100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:09 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000002044800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 483.582566][T13783] loop3: detected capacity change from 0 to 4 [ 483.592085][T13783] EXT4-fs (loop3): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:09 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x3f00}) [ 483.627256][T13767] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 483.657308][T13791] loop4: detected capacity change from 0 to 4 [ 483.675206][T13791] EXT4-fs (loop4): bad geometry: block count 2228226 exceeds size of device (2 blocks) [ 483.702551][T13800] loop5: detected capacity change from 0 to 4 [ 483.756436][T13800] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:09 executing program 3: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019002000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:09 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd2042044848000200000700000000480000006c", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:09 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x4000}) 00:01:09 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200250019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 483.870899][T13791] loop4: detected capacity change from 0 to 4 [ 483.880288][T13791] EXT4-fs (loop4): bad geometry: block count 2228226 exceeds size of device (2 blocks) 00:01:09 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600200000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:09 executing program 3: r0 = signalfd(0xffffffffffffffff, &(0x7f0000001300)={[0x7f]}, 0x8) sendmsg$IPSET_CMD_SWAP(r0, &(0x7f0000001440)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001400)={&(0x7f0000001380)={0x54, 0x6, 0x6, 0x101, 0x0, 0x0, {0xa}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x20048800}, 0x841) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = accept$inet(r1, &(0x7f0000000280)={0x2, 0x0, @empty}, &(0x7f00000002c0)=0x10) ioctl$BTRFS_IOC_SNAP_DESTROY(r2, 0x5000940f, &(0x7f0000000300)={{r1}, "3040894fd9e4e9b8b7b284ca3114319136920d624dc377df90a3ecd950690eaf4f3f377cb7aa578bc02216fcafef20401fbbf51e2f91179ab19abebaa2db7f2330c13f17e8308c4ba3ea94a34c3deac17274a20f7df4efff294163d395522ba68c9d2c404b5290f0ca3c0393a27d89e24f7f13b6fb56571205288004f2c8ea11c1e8cd92dd3c46cdc8d2e42ac8705e8a08e78e386d87ed268b645ec1f9b331017734311d7f2630f9e3dfe3d53783e665ba5ef0b41a2465361870f1490b11acf2f8b12cdd03b9358e9fc159bdccc0462752f44a3e49d76d2815a5d7cc640ee588855c5b4621a124a34aea5ff5afa6b8cdcf5dfd63ac4aadc42f893f56bff175f9e415c6781f164936917ce4713dadf60aeb7b1637fa603dd1da830061b457ff607500f8ed116f36eff8d179ce4d14955ccbd6b20d35f5250d4006353e17f2dd6108e3fe7be0a997ee0604fcf25bcc7663e5cee7615bade014516d432b8ce500fb3a8ecb4f0f60abb7bd92993b8da214674865c025e3876e4d835432a516bb79f8a461f01ffdd8b53d16193c14f33be42bea81f2834ecde1559af9ed3a386918c549563de129a15585434c158a78bb758e8e4ee1c660eee6177c1213d4f9cae94615b23b81fda2b215cbcb562d391055efa4f71185dfe08c16ccd22f8eb24cb9d5bdecb98a275443462ba004fd0f0110597eda8a1eb4f492a52b457b6bfce1f7d167ec2f4b6216298b7b3aee05b54a2187a78509a7c6933f5a2346bafa5844cd2b6b43bbdfcdeccdbb14b704671729fac4da0b7096de8bd1a8d231491f12a831b7667aa59b5262172cebf4f5d9b2ea13bf4285b6cd86844bbbc870c88ef85b5aa7a36e1ec145446598c6d6387440bd76368e48f11913873f3b5aaa6beaa49c5264a680e277cf3b122e6f9950e29437fc99b39a7f20b0157367d7d4d3dff0735f14ed2999dab4da1984402f9c3977232b8a39ec66bad618a07fc6a71fabdda362022bbb8f2c19f0dfb1537fa5b55283ad38c6286837d854b4b83d4ccf49f6242216d87189eec226ad55e8b1fcf7fe11d6c2bc4c252712147aceaa8a61fdb04103878db0f80a44e5ee76850f1ab3efe347b13057a14a70c74c42fb6c83fa16623c1938d4630c61fc21df1b7c0387ba9f6b2020b68105b63a14e360eb836975fdb2802136529138032e1c933127f9c5cb76011563dd52e5002646b52a4ab4ca28e4f7d508fed5e3d0badd38ade1063cef654523baa618218315401bc738eccc3f1eec36873603894976380dd378b9fe39f81d3a598e186df4485335a4d867d47299047cb1155fc94703796cd3c62fac67d645e3d58bf48894ee6bf2835a281e771e6619053c751a81cf5e1160e2ad4ef10bab67ebe173b3873e62058624bc71cb7b519ab648660f8d92cbd17961c385db4f0c97cbf5d7bca37c484ed6eb356116d62019f92d4ec8679abe1ac014dab926cf92d66f7758f92bfc6a8898e4147ed82a5d636cd89fed22dc180d529abd0b6c52e1104a5942eced13eeb24b0ab6d37474290cd941a959fa81408365e9936b8556315aac540785caa85a610f9d23dabc9ddded45af40680f8ca180a42f00ffebaf8c7ddeb0c568232ade23f3a73a4b091ad189de9a7404ee3e2af7202e4f16c604f9f8a61d148e5bf2496957f38b6130f15f97e0f4e07a852033472a7e8b52e832db89337f9ce41503cce93462bf8a060f79b40196d139ee2db5412af89ae695adacaf0b1e4ffc5abd2a087c4a864aa056b22c4a63b0aec6b5adfc5668b9f46d652fec19d7f97b83f569a0a5595236e5f03c3631a6a9b2d528bc77eb1062588ca1100c7fb4036669e761653a6bf17e1c28fa4e659b9049d8dc50e92e4d36972b11f085cca3b0f4a2da1965dc9c91e12d822a529a381c689a43fca0ae4209c7aa363075310053bed4c92bcae56399d46f0de4e152b699ed74402e6a7bc28d07226dcd348f8f1f08b451880e049f46623b05e861e0eb11c18a03465a277a62d9b62a3b880ae451ae19d29e157a89a44cc847252f4a385517bd77857b9150b857d83206c27532d9e1a0cbd65d91df49b337df07e48808636c9ef33c7acb3b9eaff04c32345b1ab7544f2e487d7917c5d90581e433e50ea8997393cafe813549bf42bd910bba62d0a5f61aea52d4be3d2b8d71e2e10279a0417ffc613d66d405ba0c2ad311c1252e3ea0411b40d2142ed976f3bb1549f5cf8536c8f8c148e7b9e389c890e62fd84f18873ae1d70eebbf02137daba6ce33b33e866dac93c79f216c31391af54872f5bfe5e392d28be4a3209ecb502aa37fc9bb5892e4ecdebf1cc0a301e35359abafc4eadec9c64f904065317fd13a0d2e7d41e4cd5edba8c2aab2b51c1532ba23d8fed479b59265de4dd64de03614cab43d4b2f595504fe0ef52aa3f9a1d18452bd20c017d89418b42b75f4b6204b71b59ae86e424c7a8d92de3563c35de5944d7187977d162f210586a8cac2d511cecf1ea693792569acc82e8cdefe798b51f99c048bbdfd21f10c977ab1a25571ff9bdd55c62a6115d06010255d69fb15609e5db6444ce6969f265f0bc986dfd5a8935f1c6b568245386dfac48723a2c63498f2294261d0750bcf3159393bf4db49df8616cd3536373fc8df2c684269c57dc7af3633f00d51ed1ad6065d6e704b9cf224cbe8a15b7de2ee3c30c1afd7cfdea7e632a2b9f81e57d03d39e99e4f49efe9f487a03ac8f71485276c7721059eddbd221f1cfe333b773aa4d735df6fb06bd68b7242d01964d56fa6f80c7e5667151e7212155b233a6798e2643887dbf4881d3f3161ee825457a5bc4de3c2ebafdb91be4f3af6505119d4f41a3a4b243dd0a50efc8bded83ea983de3dd2054ae0f51f7e3778328fa0f25015f6d3032dc4c3a611597b11388e72aa6370acb764cba4d97d7e219c88f3f41a134805654d831ec40bfca980c6b1d13ed54f58fbba3bef5fe7ae4bb4d4fc5dfe47ff456b5787d4dd3265bd0d5f51ab548e7416cb46ae3d1a847d30b8880bf57df36d9d4a236b3e1e082e33942d7426f2d4e231307f3271ca30c50c03e12d9111c8b3237cc520c4ad2c1cfa9b7b400610b3c6017a857e213e027cc28211d7e2d3883ae922c8d3d190fca98dc992fadb99a7d5114fd5b82260967155d4a3a548798f44c35da8fae7ded9caa4f94702fa845986661cda349f37e129102ab5d1e4980bedccb5fcf8de58d3a31d99d2f913c487aa36507ddf60a8a4e37640713d1df75a2c1d091a1594336bae91ce368eaee87bb9f074d5b21680c7d27154a651439d205827cc02d6813fc2ebc06e171685d24f770b634be1d08f4ba379c0b0e7b757e79f112d0d890a0d067b28711d80c58b8a25febff6a88171e1bd23ba2f515e43ce3f166c3c464a1a704aa892ce596c06a351d69960830a9cd54d7b192acd9a85fe9d69110528c5d0e79c1c8e491a9a8cd54fd6c643f9b9b7d76f7dcb11860f376aed02f655cf5ea855d0b2f8b9519fc2fff17d53e7469b80c72f999b1a7f14b1a00443819a72aa472b7f12b051859384a950f49b2c87a1cd117c849d189fd337bd4225b565c91e94bf8264d821c9570c04830fd253dab60178efa151d44933b79bbc8aa600e9b6ec1be6b490a546adc3ef66aa74712f330645800ab5089d27914cb340cc685ecf55b228c1f4a8fdf7ffea041a127bdd673f8efce211bf31ea7aec89c230a11b87df8cd68151ff596b9594baa45c0d02a889457fadb71110d1da825d292c83b94f93cb5ccf5b48a1fcc2b47bf77b37e11fc79892e73085c273804fa9b6241c7e4815987ece41cbfc0c70d45699244cf488ad7f3251f08ba718e18c1bbb2e4d17d7eb1c947cdd1dbddb9eac81b848a593eae32686883a04afcf932f9d3ca0bf2664a4affac4c7104072e994d234c3b30b3cdb0c3783f4dee3965b38cdcdb9bcf134cdea0c1800de1eaf86febfbdaa3487082010810476af049ddf47eea5d7a6256bb2aa06b8344bb0e2da8dad0b605e22494d5d71ba5735edbf3c08b3c4536e580e0dd1ea7951b803218017b3cf1b000895b17ec35277c58d9502edb7b9170b59363ae2ac95b40ad3f5712423da401001c42bc20217f28f1c51c5c2b2c3bf72a1361337d64de345c0f94c9473d2ffde993a16653db176ac8b3e1d1adb47f951b820e2b25900fe470b95c2f75a0c0106ed0e93b8123f7e298354f30fe683a6ad57028e28a7a36f705032a3078adab1d6ce89b8a9404fac2f7c01aadec2edf58fefad5a2ecf18579370b673e406379c24c9c239f22a14ef94abc67086fee33aeb79db247829c6cc0e796f6cab0f9310b275a80c3d68d82a87ee55197400b5127992305ef0c279bec74ec79cd1c4418d1e41a532e243a1d3b4606283ded02fa5d2096a75cc70220cdcc972698dfc4ef0db0f261f8a568891f18b3adfc33c6835e51e9c5434e29b74401c999a85fd890cf1c15bae2a84fd6afe3e8b912daecada29c6eee0127793bc393ce0402c6d2734eea5a77b94418c56816c5145ffd53f3b5daeeeed3f27315973a48b292135eec3d7b9f8aede956abf2f3285824cba8bad1d8dcc9b6a3a633ed89418e9adb44391a855e0480dd55eb57f412bb40030b65d6b26615415799b974d2b3eb525d63e25d6afb646ec15009e1a06f0051c9b2b531b6cde5ab8c06ce0eba01b9ac71f22302f73265a57c9195174275bfb87663de1288a61c5a0b945f5e7628d019a2d485aa5637657e479fd7e6e97e1f63a0d6400b383e5552ca60ab114264af7551394e3b10fe477ad4f6401ef7324aa365ab50ae210dd112ca25666afa011389e80e79dbcee3fadd539584b79ddfce1882bd52f315d7405b5e3b8491be118183e390e29fd73134c52cdcec8aaf879e8f3f0c0958dfdb379660d934459a3ed69f8cff13f43f25f6db0919ef6e609a678e0da4df91d0ef4da5b7449759325a3aaa526fb9bafe2b88f9d822df35b295ada9b7073b532df69171f5bb9a476788ebf28d32f95f6a63dc791c6ef48238c4859906ccf90def79169a0ed1447a9afc9e860299d314029ff976df73f95633f942b814bc6cf8832024e02fb388aa2a6ca6285611814afb1420b05ef667571e80c6bc48822d84a53bea426fcd090ef250ac6fd71aa89ca76bdd88041959f5dda97d0f5394e7f5c8d335ca0741c737a5ee0cfb9ca6b68808b1c1a7904ccdd5405ba863854936130ed4c2f704ff7209a407acda5cab9f371d78f574956b76caa7d64f7e96ddfe13267e9dfbd74d9ab911c6106e442e19ca4b41d3dcfee9f84cf9382b1a66104d65edf4794504c05df1380a42c756ae73ebb78bc1e5e58df48b31eb6d159700125619ec3cb06303e66303b6a8748c2a5625bda5bfd59abb13b11c8be8e94670e8c43e5947ceec32063ecaeb5698e7e30a749d6a570fe0aac43792f3116a2ecd6bbbe0dc46ad1d036172a7b2841dfc4dc6f25687a102460b1b8cccd5bcb923cbe833a10065884a187b3a0af9d324103adf987019aabba269aea97e02b276228c5c5f5a8d17598ec21814078755ff017697ef382e88b26b9c5909ad55a6736f7ab94f2e151bdd4bff9b440e10755b381af38c5a64431a86dce66b87b36b5db0acb6c76572dbcfd5408cb93f474b90a7d5190f017de962f2175c91fb6c698609a4cc3ac82c549e026544f25e0cc21318dffc1c59d8c1dcda9977ebc0f612c584a9a189b307d720117a1fa29cc36f40a6899fe9875eb1598d5f9e95ea9235e770858335f0e54c10becef0bdeff31b75d85a6517fa352450e8db9076c"}) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x88800) ftruncate(r3, 0x8) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(r4, 0x1, &(0x7f0000000240)={{r6, r7+10000000}}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r5, 0x0, &(0x7f0000000180)={{}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) getpeername$unix(0xffffffffffffffff, &(0x7f0000001480)=@abs, &(0x7f0000001500)=0x6e) [ 483.914738][T13800] loop5: detected capacity change from 0 to 4 [ 483.926951][T13800] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 483.940723][T13832] loop3: detected capacity change from 0 to 4 [ 483.951937][T13832] EXT4-fs (loop3): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:09 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002002e0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 483.986132][T13850] loop4: detected capacity change from 0 to 4 [ 483.989068][T13837] loop0: detected capacity change from 0 to 1028 [ 484.003844][T13853] loop5: detected capacity change from 0 to 4 [ 484.011517][T13850] EXT4-fs (loop4): bad geometry: block count 2424834 exceeds size of device (2 blocks) [ 484.027311][T13833] loop_set_status: loop0 () has still dirty pages (nrpages=2) 00:01:09 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x4800}) [ 484.079809][T13853] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 484.127254][T13833] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=1) [ 484.159661][T13853] loop5: detected capacity change from 0 to 4 [ 484.172177][T13871] loop4: detected capacity change from 0 to 4 [ 484.172198][T13853] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 484.194588][T13871] EXT4-fs (loop4): bad geometry: block count 3014658 exceeds size of device (2 blocks) [ 484.208472][T13872] loop0: detected capacity change from 0 to 1028 [ 484.237273][T13872] loop_set_status: loop0 () has still dirty pages (nrpages=3) 00:01:10 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200002040200000019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:10 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000074", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:10 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600300000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:10 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002022f0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:10 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x4c00}) 00:01:10 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd2042044848000200000700004c004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 484.545069][T13896] loop0: detected capacity change from 0 to 1028 [ 484.548732][T13897] loop5: detected capacity change from 0 to 4 [ 484.558062][T13900] loop4: detected capacity change from 0 to 4 [ 484.560313][T13897] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 484.567013][T13900] EXT4-fs (loop4): bad geometry: block count 3080706 exceeds size of device (2 blocks) 00:01:10 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x6800}) 00:01:10 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd2042044848000200000700000000480000007a", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:10 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002003f0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 484.630124][T13900] loop4: detected capacity change from 0 to 4 [ 484.637543][T13900] EXT4-fs (loop4): bad geometry: block count 3080706 exceeds size of device (2 blocks) [ 484.647559][T13897] loop5: detected capacity change from 0 to 4 [ 484.660315][T13897] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 484.798493][T13941] loop4: detected capacity change from 0 to 4 [ 484.806468][T13941] EXT4-fs (loop4): bad geometry: block count 4128770 exceeds size of device (2 blocks) [ 484.838916][T13932] loop0: detected capacity change from 0 to 1028 [ 484.865183][T13941] loop4: detected capacity change from 0 to 4 [ 484.882436][T13941] EXT4-fs (loop4): bad geometry: block count 4128770 exceeds size of device (2 blocks) [ 484.897399][T13939] loop_set_status: loop0 () has still dirty pages (nrpages=4) 00:01:12 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)={'#! ', './file0', [{0x20, 'cpuacct.usage_percpu_sys\x00'}, {}, {0x20, 'cpuacct.usage_percpu_sys\x00'}], 0xa, "33e2c9bcfa74ff1f7b596a378885df3ea570563d5c71ae8fbb13e3f97806dd4f87044a5cd9f92ec501edb782d7f4c0"}, 0x6f) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) ioctl$BTRFS_IOC_QUOTA_RESCAN(r2, 0x4040942c, &(0x7f0000000040)={0x0, 0x9000, [0x569, 0x6b7f, 0x2e, 0x32, 0x5, 0x2]}) 00:01:12 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600400000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:12 executing program 0: ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000140)={'syztnl1\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x2f, 0x1, 0xe0, 0x3, 0x40, @mcast2, @mcast1, 0x40, 0x700, 0x8, 0x1000}}) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)) bind(r0, &(0x7f00000002c0)=@qipcrtr={0x2a, 0xffffffff, 0x7ffe}, 0x80) r1 = socket$inet_udplite(0x2, 0x2, 0x88) timer_create(0x3, &(0x7f00000003c0)={0x0, 0x101, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000400)=0x0) clock_gettime(0x0, &(0x7f0000000440)) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x77359400}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000240)=""/102, 0x66}], 0x1, 0x9, 0x0) 00:01:12 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200400019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:12 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x6c00}) 00:01:12 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048ffffff97", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:12 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600600000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 487.022164][T13974] loop5: detected capacity change from 0 to 4 [ 487.023197][T13975] loop0: detected capacity change from 0 to 1028 [ 487.035708][T13977] loop4: detected capacity change from 0 to 4 [ 487.046817][T13974] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:12 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x7400}) [ 487.116782][T13977] EXT4-fs (loop4): bad geometry: block count 4194306 exceeds size of device (2 blocks) [ 487.128424][T13979] loop0: unable to read partition table [ 487.134387][T13979] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) 00:01:12 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048041b51cf", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 487.165995][T13977] loop4: detected capacity change from 0 to 4 [ 487.197589][T13979] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=4) 00:01:12 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600700000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:13 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200480019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:13 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29e58e69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 487.220704][T14006] loop5: detected capacity change from 0 to 4 [ 487.234814][T14006] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 487.235010][T13977] EXT4-fs (loop4): bad geometry: block count 4194306 exceeds size of device (2 blocks) [ 487.270575][T14003] loop0: detected capacity change from 0 to 1028 00:01:13 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29e58e69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:13 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29e58e69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 487.346588][T14024] loop5: detected capacity change from 0 to 4 [ 487.355125][T14027] loop4: detected capacity change from 0 to 4 [ 487.364438][T14027] EXT4-fs (loop4): bad geometry: block count 4718594 exceeds size of device (2 blocks) [ 487.377368][T14003] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 487.389557][T14024] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 487.401266][T14010] loop0: unable to read partition table [ 487.407512][T14010] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 487.433018][T14024] loop5: detected capacity change from 0 to 4 [ 487.484159][T14024] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:13 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r4, 0x1, &(0x7f0000000100)={{0x0, 0x989680}}, 0x0) timer_create(0x1, &(0x7f0000000000)={0x0, 0x11, 0x0, @thr={&(0x7f0000000140)="6a25e4ff1f60f47d2f5af869e53c", &(0x7f0000000280)="02f6c9bdb0c2c3951d7165f79e806cfdf1955b4494a827c57184ba7fc5e7ac47cf521ec22d0ab42dfc05e6df0ab92fc134b9d999be2c285ef64d8dbe0f381fdfcf8eaf7c30408d887ab962a4c813e7240aeac6202ca921dc90be5a8bffbfbeff5510c6b9ad8cc12a43dfb74aae1de3966bd08384dc8daf341543242cdd6ca8d24693c79fbb3ad6f794cda8f9b6388dab7eb183d42b9553cc76573febd5a326a0b8b3bf7483aec4ba53a3168a886060ce2559e5030bcda56bc45af744971711c0a78610cde795e2c12335fe37123027808e71012f9f01d541cb3bd41f372fad3090957109c86944"}}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r5, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) preadv(r0, &(0x7f0000000140), 0x0, 0x10000, 0x80) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) timer_settime(r4, 0x1, &(0x7f00000003c0)={{r6, r7+60000000}, {0x77359400}}, &(0x7f0000000400)) 00:01:13 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002004c0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:13 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048fffffdfd", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:13 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000000340)={0xe9a, 0x9, 0x1, 'queue0\x00', 0x80000001}) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) io_uring_setup(0x701c, &(0x7f0000000400)={0x0, 0xe764, 0x2, 0x1, 0x337, 0x0, r3}) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000240)=""/234) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 00:01:13 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x7a00}) 00:01:13 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600800000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 487.877190][T14059] loop0: detected capacity change from 0 to 1028 [ 487.905853][T14064] loop5: detected capacity change from 0 to 4 [ 487.916327][T14063] loop4: detected capacity change from 0 to 4 [ 487.925819][T14063] EXT4-fs (loop4): bad geometry: block count 4980738 exceeds size of device (2 blocks) [ 487.930008][T14064] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 487.945453][T14062] loop_set_status: loop0 () has still dirty pages (nrpages=1) 00:01:13 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000600004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 487.975151][T14064] loop5: detected capacity change from 0 to 4 [ 487.977083][T14059] loop_set_status: loop0 () has still dirty pages (nrpages=2) [ 487.992502][T14064] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:13 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600a00000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 488.018411][T14063] loop4: detected capacity change from 0 to 4 [ 488.070636][T14063] EXT4-fs (loop4): bad geometry: block count 4980738 exceeds size of device (2 blocks) [ 488.077009][ C1] print_req_error: 80 callbacks suppressed [ 488.077023][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 488.097711][ C1] buffer_io_error: 74 callbacks suppressed [ 488.097733][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 488.103238][T14095] loop5: detected capacity change from 0 to 4 00:01:13 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xff0f}) [ 488.103866][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 488.115272][T14095] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 488.117846][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 488.149583][ T1033] loop0: unable to read partition table 00:01:13 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002024c0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 488.160255][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 488.171680][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 488.180302][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 488.191687][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 488.199611][T14075] loop0: unable to read partition table [ 488.205615][T14075] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) 00:01:13 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000400)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) timer_settime(r1, 0x0, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, &(0x7f0000000140)) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 00:01:13 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048fffffffd", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 488.227386][T14095] loop5: detected capacity change from 0 to 4 [ 488.238912][T14106] loop4: detected capacity change from 0 to 4 [ 488.245464][T14095] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 488.260482][T14106] EXT4-fs (loop4): bad geometry: block count 4981250 exceeds size of device (2 blocks) [ 488.333409][T14106] loop4: detected capacity change from 0 to 4 [ 488.379070][T14106] EXT4-fs (loop4): bad geometry: block count 4981250 exceeds size of device (2 blocks) 00:01:14 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r4, 0x1, &(0x7f0000000100)={{0x0, 0x989680}}, 0x0) timer_create(0x1, &(0x7f0000000000)={0x0, 0x11, 0x0, @thr={&(0x7f0000000140)="6a25e4ff1f60f47d2f5af869e53c", &(0x7f0000000280)="02f6c9bdb0c2c3951d7165f79e806cfdf1955b4494a827c57184ba7fc5e7ac47cf521ec22d0ab42dfc05e6df0ab92fc134b9d999be2c285ef64d8dbe0f381fdfcf8eaf7c30408d887ab962a4c813e7240aeac6202ca921dc90be5a8bffbfbeff5510c6b9ad8cc12a43dfb74aae1de3966bd08384dc8daf341543242cdd6ca8d24693c79fbb3ad6f794cda8f9b6388dab7eb183d42b9553cc76573febd5a326a0b8b3bf7483aec4ba53a3168a886060ce2559e5030bcda56bc45af744971711c0a78610cde795e2c12335fe37123027808e71012f9f01d541cb3bd41f372fad3090957109c86944"}}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r5, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) preadv(r0, &(0x7f0000000140), 0x0, 0x10000, 0x80) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) timer_settime(r4, 0x1, &(0x7f00000003c0)={{r6, r7+60000000}, {0x77359400}}, &(0x7f0000000400)) 00:01:14 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x20000}) 00:01:14 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600f00000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:14 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048fffffffe", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:14 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002024d0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:14 executing program 3: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000002e000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 488.734176][T14149] loop5: detected capacity change from 0 to 4 [ 488.742492][T14149] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 488.752311][T14148] loop0: detected capacity change from 0 to 1028 [ 488.763155][T14153] loop4: detected capacity change from 0 to 4 00:01:14 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000601400000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:14 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) r3 = dup2(r2, r0) ioctl$BTRFS_IOC_DEV_REPLACE(r3, 0xca289435, &(0x7f0000000240)={0x3, 0xacc, @start={0x0, 0x1, "fca9591659ed58b37dd863833f182d1fd2602b47947348b3975d162932ace7e5fb22c885fc5b8592f1e2912fc49a40e727fcc74fc60dea06ed0553e17836e053945357d372d0df00872720f39c1f53899671cbb233c4649e63e79eecbca8c3c9eb6049fb263758aeb902f3bc8158cf2e4ebbceb4edfc9f3d892ca702f05f7a15ce4ad707192388f0a4f1d50128995c432b3d5db49a2159f1b3b3ea8b0f2aecbee5fcb5388ed0e7b4acd074de9f3abab58ae13218baec3386489fc8e37a9d6e57a1327f5b91eab0db9a370cd8c6f8e61b927bcd52b3475892b5eb1bcc730b455b5eab3d5861f6fdd2fd3cfa64c19a9eb689a96dc78653fcc0b500af16baaa4d472e8fdba14fcd97e411d2f031bce2d497ed482d764e1c0d4f720270ea6c389dc115a74adb17baa76fcee7327d2e48c8eb86f9cbe791957131e597a2a4eff18f8888cfd73b93683db88a097acb241e0ad564070269e76c18290a270ccbcd83045a6be01fa9985c42724f32a6b4efe41bda725524cd2c8d634095581f1bdbb5f329f9f13332540eeba9e669b5a027eed0ac8691d15d04624693f0c85298df31af7a24a8cf47e570ab7439a8692a707e0e8d66979cb1c909f0149424f7050f64f2178fb6d253281f6bb84f471590ce82a1d4d28d209d527cdb4bdda103e13b9505104b03ae13827a449b8fc883e8e80d4964da199ea040dfaa295b00647a43dd72ea0cb7f709b499402db6b16f76b623c3343c7ba68821a5a341f3cd82fc52c55da0b149c065fd4462d80aa55c36747d0cdad2b012cd58eb12961da3f1c76ebf3d818da3eb12e6e4dbedc1ed57dd278e1076099e093e6bd34c3a7e6b514c3e51ba077fbd1e5b563f1f95016eaa4ce3fba3d6ba9727b31de10fdacf655bd960d7c916fd3bdb2129b22055232787e4b61c9c1a25c140fa3f3e14d8ae394a2dd707416500de64432de463cebb10bcefb833ba46ecef5a030b490f0f5bd89525d23447faedb092c2e821b7aa1787e0795edf9240d25d6bbf4fc85df5e5f64a05ef4898701eaa943ac0db6c7f3db3a22c7b98d8304ea8b84834db6cf84e7a539212d4cb2e6190512d70289457f9cfde03b5fd93fdcc3fcfb1f5e81f88cc7f95e913247a6566bcd63773d1813e7900a549f439e0ef1c7e9b74ad55d618c42572d042b9d96b86100973c455bd0fd31807b2610c76c62afb6a7265e3a491ed7003118874d53f05e440580b03b75d0c6e9c0d2f12e8a84fac346d78648e91977159178580bdb87e04723f6ec550ddc101e38a2129c2500fc9226db69ae305ecc6cb77d645a425e9fdfcd4627df69ee229046f4be2dda66d02484baf450d6ef6c7db8972bd8d26260c99f2604ebb5f41028d8509ed0fba50117ebf504c624d0237a3bc2e51088c320690bfce3a71435e9a9771f4c0f51f01f007999c076e5d48904b825d2a13fcd9", "b9e04fa5a0b8a4c410216132c6fd411a36613c287bf1d5ed67a71423b49e93f8d161a06fd0e20f636cb5f84cf2875a29b44f1d5fdf7ce1e1defa492cf2ca921eeef1f066e0470e5bdd8b1db38425b14a536f7f181037934b8fd4f6837e21041f0ba5105b435de7ba354ba812baac6d61feaf44ab2b8f6aefd38cb399f10f1131b1db3c9937f4a8cd95915b906990d2cb2a815b6e81b2c951495faa50f4fbdb09519288a5f243a3f306e6bbadc3f23b68a8afb7740a337642c006e95d648c5e9f8bceda0fdca113be85169448bd4ebfb7d36f288bc59ddcee5cd3030cf52b33a77170a185748a1c59d8ca6c2d4d7300cffee313207da9c86e793625f6fd6533347d00d62a6d047f03b5187100ec3321fbe7c9f0ab7e36dd76f8581c4fe359c02a3bed0b54af5b6a33ccf9e8e680205ee2c02e5685651ae8ffac052517f686c11a0421cf5b1281a95c7ab72b97d4ab13c6f95aea3fe134da212fa9ba7f43d6522172e7c678e8ee3a484823d1c3c24dd3fa072a2edddbd846fadeb0b00fcf91e3e13380edbdabd1d95f28b37bcf188d83bf8788f300bfaac4ea866efde2a073049620e8912f8789652a5ec026d54c5f6d40ecf6247516f6552b67db26c192034b476b600dc4e3a741a555a9ae380999f9d6031960728135b8983f43cf124d2f8d2e7c244de98ca927fd171f2413d51898ea4155758e4c3f02f29f7df0562b4a48634df581f5498118145057dd93f945b0e27a8b6eccf1498ef1c1433f970c8626814aa22831ae0bbbe76407136c61611810769e3b0e8c52179985d5861bec11df2c1d3271b520fd8cddc0a1242607fe1f5e22737e17eb5e0407878eb404b5c448cda749008af785f9eb4391dc817d84f08983af0f4169bddca1f05c4686615646a45ba89afebfeb3cb3b0d6fca29629ba983050dfcc3a8db2b85a72df6e9aaaab72b178efd448cd05a176a421820751bd57069f00a1661ad4f4ff5543a4f7507e78e6fc5267d3fdb08a7610eee16dff6549f6b00b38544d96143109429f481bcaaab13fb397662a024d2a9ad338a31ffab7afd893cf9c55fb715dc270180eb121ea7dcafa68d1ef3208d95a2bb34867b2f012056a8c29bfc4d81a3ab4411f57e43cb1559a4b6d05081308558bfce5cc3dfaf1722deecf8af918bb6814089794088a801824af98a8acf063f102d38eede1de103052ee5ee86b0613e598228c3a329d5ff99deb1b6a62b920f88ea038d7c0309697f57ec1d5fbf2435fe1bfda3dae2c778f04bf9dd4f1a99bd843c6a6c03806d2b22eff19a8eae8b8d6eef3295844bfb9ffacf14ee4ea2d6f8509b419ae71a5cd9bb7d00922ee354b312365585a73303ecd18e98fa0621d17d01806f2ca4b86a315d92d4019f88f3a271fbd7251e098c9e36eb6092dadbfc8add85b2cccdb5232a54072412a1489bb277c74aca7b61ba0"}, [0x200, 0x5, 0x7, 0x7f, 0x2, 0x6, 0x8, 0xd8, 0x3ff, 0x7, 0x10001, 0x9a6, 0x1f, 0x1, 0x8, 0xff, 0x9, 0xffffffffffffffe1, 0x2, 0x10001, 0x2, 0x3, 0x42b, 0x7fff, 0x8001, 0x616, 0x2, 0x401, 0x5, 0x6, 0x80000001, 0xf67, 0x5, 0x8, 0x100, 0x7cd0, 0x6, 0x5, 0x9, 0x46b1, 0xfffffffffffffff7, 0x1f, 0x200, 0x800000000000, 0x2e, 0x5, 0x6, 0xe8a, 0xb195, 0x154, 0x7, 0xfffffffffffffff7, 0x7ff, 0xb8c, 0x2a, 0x8001, 0x9, 0xd4f, 0x4, 0x10000, 0x1, 0x4bf1, 0x1, 0x4]}) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) [ 488.811069][T14153] EXT4-fs (loop4): bad geometry: block count 5046786 exceeds size of device (2 blocks) [ 488.831031][T14149] loop5: detected capacity change from 0 to 4 [ 488.831194][T14171] loop3: detected capacity change from 0 to 4 [ 488.842096][T14149] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:14 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x80803}) 00:01:14 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048fdfdffff", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 488.855196][T14171] EXT4-fs (loop3): bad geometry: block count 54 exceeds size of device (2 blocks) [ 488.857055][T14159] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=1) [ 488.887969][T14153] loop4: detected capacity change from 0 to 4 [ 488.898469][T14153] EXT4-fs (loop4): bad geometry: block count 5046786 exceeds size of device (2 blocks) 00:01:14 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200600019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 488.946259][T14191] loop5: detected capacity change from 0 to 4 00:01:14 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x1000000}) [ 489.001101][T14191] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 489.037016][T14189] loop0: detected capacity change from 0 to 1028 [ 489.050229][T14210] loop4: detected capacity change from 0 to 4 [ 489.059481][T14210] EXT4-fs (loop4): bad geometry: block count 6291458 exceeds size of device (2 blocks) [ 489.107573][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 489.118506][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 489.126749][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 489.126788][T14210] loop4: detected capacity change from 0 to 4 [ 489.137918][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 489.138807][T14199] loop0: unable to read partition table [ 489.144742][T14191] loop5: detected capacity change from 0 to 4 [ 489.167292][T14199] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 489.180283][T14210] EXT4-fs (loop4): bad geometry: block count 6291458 exceeds size of device (2 blocks) [ 489.216490][T14191] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:15 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r4, 0x1, &(0x7f0000000100)={{0x0, 0x989680}}, 0x0) timer_create(0x1, &(0x7f0000000000)={0x0, 0x11, 0x0, @thr={&(0x7f0000000140)="6a25e4ff1f60f47d2f5af869e53c", &(0x7f0000000280)="02f6c9bdb0c2c3951d7165f79e806cfdf1955b4494a827c57184ba7fc5e7ac47cf521ec22d0ab42dfc05e6df0ab92fc134b9d999be2c285ef64d8dbe0f381fdfcf8eaf7c30408d887ab962a4c813e7240aeac6202ca921dc90be5a8bffbfbeff5510c6b9ad8cc12a43dfb74aae1de3966bd08384dc8daf341543242cdd6ca8d24693c79fbb3ad6f794cda8f9b6388dab7eb183d42b9553cc76573febd5a326a0b8b3bf7483aec4ba53a3168a886060ce2559e5030bcda56bc45af744971711c0a78610cde795e2c12335fe37123027808e71012f9f01d541cb3bd41f372fad3090957109c86944"}}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r5, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) preadv(r0, &(0x7f0000000140), 0x0, 0x10000, 0x80) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) timer_settime(r4, 0x1, &(0x7f00000003c0)={{r6, r7+60000000}, {0x77359400}}, &(0x7f0000000400)) 00:01:15 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200680019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:15 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004897ffffff", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:15 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000684800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:15 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x2000000}) 00:01:15 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000602e00000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 489.630396][T14246] loop0: detected capacity change from 0 to 1028 [ 489.640166][T14249] loop5: detected capacity change from 0 to 4 00:01:15 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000606400000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 489.687873][T14249] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 489.689544][T14252] loop4: detected capacity change from 0 to 4 [ 489.716972][T14246] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 489.729457][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 489.747607][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 489.748215][T14252] EXT4-fs (loop4): bad geometry: block count 6815746 exceeds size of device (2 blocks) [ 489.758676][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 489.776491][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 00:01:15 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000684800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 489.787539][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 489.795756][T14248] loop0: unable to read partition table [ 489.801685][T14248] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 489.822673][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 489.834975][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 489.853067][T14252] loop4: detected capacity change from 0 to 4 [ 489.864262][T14275] loop5: detected capacity change from 0 to 4 [ 489.864485][T14252] EXT4-fs (loop4): bad geometry: block count 6815746 exceeds size of device (2 blocks) 00:01:15 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000684800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:15 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x2040000}) [ 489.874113][T14275] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 489.881350][T14265] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 489.902395][ C1] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:15 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002006c0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:15 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048fdffffff", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 489.972899][T14275] loop5: detected capacity change from 0 to 4 [ 490.040159][T14275] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 490.121326][T14296] loop4: detected capacity change from 0 to 4 [ 490.182860][T14296] EXT4-fs (loop4): bad geometry: block count 7077890 exceeds size of device (2 blocks) [ 490.249803][T14296] loop4: detected capacity change from 0 to 4 [ 490.264179][T14296] EXT4-fs (loop4): bad geometry: block count 7077890 exceeds size of device (2 blocks) 00:01:16 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060fe00000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:16 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r4, 0x1, &(0x7f0000000100)={{0x0, 0x989680}}, 0x0) timer_create(0x1, &(0x7f0000000000)={0x0, 0x11, 0x0, @thr={&(0x7f0000000140)="6a25e4ff1f60f47d2f5af869e53c", &(0x7f0000000280)="02f6c9bdb0c2c3951d7165f79e806cfdf1955b4494a827c57184ba7fc5e7ac47cf521ec22d0ab42dfc05e6df0ab92fc134b9d999be2c285ef64d8dbe0f381fdfcf8eaf7c30408d887ab962a4c813e7240aeac6202ca921dc90be5a8bffbfbeff5510c6b9ad8cc12a43dfb74aae1de3966bd08384dc8daf341543242cdd6ca8d24693c79fbb3ad6f794cda8f9b6388dab7eb183d42b9553cc76573febd5a326a0b8b3bf7483aec4ba53a3168a886060ce2559e5030bcda56bc45af744971711c0a78610cde795e2c12335fe37123027808e71012f9f01d541cb3bd41f372fad3090957109c86944"}}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r5, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) preadv(r0, &(0x7f0000000140), 0x0, 0x10000, 0x80) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) timer_settime(r4, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:16 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000684800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:16 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x3000000}) 00:01:16 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200740019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:16 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048feffffff", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:16 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000684800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 490.478171][T14330] loop5: detected capacity change from 0 to 4 [ 490.517616][T14330] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 490.535759][T14332] loop0: detected capacity change from 0 to 1028 [ 490.546374][T14338] loop4: detected capacity change from 0 to 4 [ 490.558081][T14335] loop_set_status: loop0 () has still dirty pages (nrpages=1) 00:01:16 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000684800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:16 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:16 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x3080800}) 00:01:16 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060b902000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 490.626932][T14345] loop_set_status: loop0 () has still dirty pages (nrpages=1) [ 490.644243][T14338] EXT4-fs (loop4): bad geometry: block count 7602178 exceeds size of device (2 blocks) [ 490.654521][T14330] loop5: detected capacity change from 0 to 4 [ 490.711523][T14338] loop4: detected capacity change from 0 to 4 [ 490.716546][T14368] loop0: detected capacity change from 0 to 1028 00:01:16 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002007a0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 490.758557][T14338] EXT4-fs (loop4): bad geometry: block count 7602178 exceeds size of device (2 blocks) 00:01:16 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 490.846329][T14385] loop5: detected capacity change from 0 to 4 [ 490.846702][T14387] loop4: detected capacity change from 0 to 4 [ 490.862127][T14387] EXT4-fs (loop4): bad geometry: block count 7995394 exceeds size of device (2 blocks) [ 490.869967][T14385] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 490.882244][T14364] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=1) [ 490.911888][T14387] loop4: detected capacity change from 0 to 4 [ 490.922477][T14385] loop5: detected capacity change from 0 to 4 [ 490.931639][T14387] EXT4-fs (loop4): bad geometry: block count 7995394 exceeds size of device (2 blocks) [ 490.947345][T14385] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:17 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x4000000}) 00:01:17 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) fsync(0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) fsetxattr(0xffffffffffffffff, &(0x7f0000000240)=@known='system.posix_acl_access\x00', &(0x7f0000000280)='cpuacct.usage_percpu_sys\x00', 0x19, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, &(0x7f0000000140)) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 00:01:17 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000201b20019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:17 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r4, 0x1, &(0x7f0000000100)={{0x0, 0x989680}}, 0x0) timer_create(0x1, &(0x7f0000000000)={0x0, 0x11, 0x0, @thr={&(0x7f0000000140)="6a25e4ff1f60f47d2f5af869e53c", &(0x7f0000000280)="02f6c9bdb0c2c3951d7165f79e806cfdf1955b4494a827c57184ba7fc5e7ac47cf521ec22d0ab42dfc05e6df0ab92fc134b9d999be2c285ef64d8dbe0f381fdfcf8eaf7c30408d887ab962a4c813e7240aeac6202ca921dc90be5a8bffbfbeff5510c6b9ad8cc12a43dfb74aae1de3966bd08384dc8daf341543242cdd6ca8d24693c79fbb3ad6f794cda8f9b6388dab7eb183d42b9553cc76573febd5a326a0b8b3bf7483aec4ba53a3168a886060ce2559e5030bcda56bc45af744971711c0a78610cde795e2c12335fe37123027808e71012f9f01d541cb3bd41f372fad3090957109c86944"}}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r5, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) preadv(r0, &(0x7f0000000140), 0x0, 0x10000, 0x80) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) timer_settime(r4, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:17 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600003000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:17 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:17 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 491.433154][T14416] loop5: detected capacity change from 0 to 4 [ 491.447263][T14420] loop4: detected capacity change from 0 to 4 [ 491.453469][T14416] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 491.470825][T14420] EXT4-fs (loop4): bad geometry: block count 11665666 exceeds size of device (2 blocks) [ 491.481309][T14421] loop0: detected capacity change from 0 to 1028 00:01:17 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x41b51cf}) 00:01:17 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000201b30019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 491.516684][T14420] loop4: detected capacity change from 0 to 4 [ 491.523629][T14420] EXT4-fs (loop4): bad geometry: block count 11665666 exceeds size of device (2 blocks) [ 491.540260][T14416] loop5: detected capacity change from 0 to 4 00:01:17 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000608503000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 491.586079][T14416] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:17 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x5000000}) [ 491.681724][T14462] loop4: detected capacity change from 0 to 4 [ 491.693397][T14462] EXT4-fs (loop4): bad geometry: block count 11731202 exceeds size of device (2 blocks) 00:01:17 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 491.741225][T14462] loop4: detected capacity change from 0 to 4 [ 491.754958][T14475] loop5: detected capacity change from 0 to 4 [ 491.769792][T14462] EXT4-fs (loop4): bad geometry: block count 11731202 exceeds size of device (2 blocks) 00:01:17 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000203c10019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 491.784245][T14475] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 491.789896][T14485] loop0: detected capacity change from 0 to 1028 [ 491.850684][T14475] loop5: detected capacity change from 0 to 4 [ 491.856978][T14497] loop4: detected capacity change from 0 to 4 [ 491.860498][T14497] EXT4-fs (loop4): bad geometry: block count 12649218 exceeds size of device (2 blocks) [ 491.874803][T14475] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 491.877144][T14485] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 491.896673][T14492] loop0: unable to read partition table [ 491.902792][T14492] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 491.920250][T14497] loop4: detected capacity change from 0 to 4 [ 491.920338][T14459] loop0: unable to read partition table [ 491.926856][T14497] EXT4-fs (loop4): bad geometry: block count 12649218 exceeds size of device (2 blocks) 00:01:17 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) timer_settime(r1, 0x1, &(0x7f0000000140)={{r2, r3+60000000}, {0x77359400}}, &(0x7f0000000240)) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 00:01:18 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r4, 0x1, &(0x7f0000000100)={{0x0, 0x989680}}, 0x0) timer_create(0x1, &(0x7f0000000000)={0x0, 0x11, 0x0, @thr={&(0x7f0000000140)="6a25e4ff1f60f47d2f5af869e53c", &(0x7f0000000280)="02f6c9bdb0c2c3951d7165f79e806cfdf1955b4494a827c57184ba7fc5e7ac47cf521ec22d0ab42dfc05e6df0ab92fc134b9d999be2c285ef64d8dbe0f381fdfcf8eaf7c30408d887ab962a4c813e7240aeac6202ca921dc90be5a8bffbfbeff5510c6b9ad8cc12a43dfb74aae1de3966bd08384dc8daf341543242cdd6ca8d24693c79fbb3ad6f794cda8f9b6388dab7eb183d42b9553cc76573febd5a326a0b8b3bf7483aec4ba53a3168a886060ce2559e5030bcda56bc45af744971711c0a78610cde795e2c12335fe37123027808e71012f9f01d541cb3bd41f372fad3090957109c86944"}}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r5, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) preadv(r0, &(0x7f0000000140), 0x0, 0x10000, 0x80) timer_settime(r4, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:18 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000609c03000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:18 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000201d00019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:18 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x6000000}) 00:01:18 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:18 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r4, 0x1, &(0x7f0000000100)={{0x0, 0x989680}}, 0x0) timer_create(0x1, &(0x7f0000000000)={0x0, 0x11, 0x0, @thr={&(0x7f0000000140)="6a25e4ff1f60f47d2f5af869e53c", &(0x7f0000000280)="02f6c9bdb0c2c3951d7165f79e806cfdf1955b4494a827c57184ba7fc5e7ac47cf521ec22d0ab42dfc05e6df0ab92fc134b9d999be2c285ef64d8dbe0f381fdfcf8eaf7c30408d887ab962a4c813e7240aeac6202ca921dc90be5a8bffbfbeff5510c6b9ad8cc12a43dfb74aae1de3966bd08384dc8daf341543242cdd6ca8d24693c79fbb3ad6f794cda8f9b6388dab7eb183d42b9553cc76573febd5a326a0b8b3bf7483aec4ba53a3168a886060ce2559e5030bcda56bc45af744971711c0a78610cde795e2c12335fe37123027808e71012f9f01d541cb3bd41f372fad3090957109c86944"}}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r5, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) timer_settime(r4, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 492.393060][T14527] loop4: detected capacity change from 0 to 4 [ 492.399668][T14529] loop5: detected capacity change from 0 to 4 [ 492.413755][T14527] EXT4-fs (loop4): bad geometry: block count 13631746 exceeds size of device (2 blocks) [ 492.423803][T14528] loop0: detected capacity change from 0 to 1028 [ 492.439751][T14529] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:18 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:18 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600022000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:18 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x6040000}) 00:01:18 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002fffe0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 492.575170][T14527] loop4: detected capacity change from 0 to 4 [ 492.588863][T14527] EXT4-fs (loop4): bad geometry: block count 13631746 exceeds size of device (2 blocks) 00:01:18 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r4, 0x1, &(0x7f0000000100)={{0x0, 0x989680}}, 0x0) timer_create(0x1, &(0x7f0000000000)={0x0, 0x11, 0x0, @thr={&(0x7f0000000140)="6a25e4ff1f60f47d2f5af869e53c", &(0x7f0000000280)="02f6c9bdb0c2c3951d7165f79e806cfdf1955b4494a827c57184ba7fc5e7ac47cf521ec22d0ab42dfc05e6df0ab92fc134b9d999be2c285ef64d8dbe0f381fdfcf8eaf7c30408d887ab962a4c813e7240aeac6202ca921dc90be5a8bffbfbeff5510c6b9ad8cc12a43dfb74aae1de3966bd08384dc8daf341543242cdd6ca8d24693c79fbb3ad6f794cda8f9b6388dab7eb183d42b9553cc76573febd5a326a0b8b3bf7483aec4ba53a3168a886060ce2559e5030bcda56bc45af744971711c0a78610cde795e2c12335fe37123027808e71012f9f01d541cb3bd41f372fad3090957109c86944"}}, &(0x7f00000001c0)) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r4, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 492.637031][T14558] loop5: detected capacity change from 0 to 4 [ 492.656151][T14558] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 492.723249][T14571] loop4: detected capacity change from 0 to 4 [ 492.734217][T14571] EXT4-fs (loop4): bad geometry: block count 16711426 exceeds size of device (2 blocks) [ 492.832334][T14571] loop4: detected capacity change from 0 to 4 [ 492.842888][T14571] EXT4-fs (loop4): bad geometry: block count 16711426 exceeds size of device (2 blocks) 00:01:18 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) timer_settime(r1, 0x1, &(0x7f0000000140)={{r2, r3+60000000}, {0x77359400}}, &(0x7f0000000240)) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 00:01:18 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r4, 0x1, &(0x7f0000000100)={{0x0, 0x989680}}, 0x0) timer_create(0x1, &(0x7f0000000000)={0x0, 0x11, 0x0, @thr={&(0x7f0000000140)="6a25e4ff1f60f47d2f5af869e53c", &(0x7f0000000280)="02f6c9bdb0c2c3951d7165f79e806cfdf1955b4494a827c57184ba7fc5e7ac47cf521ec22d0ab42dfc05e6df0ab92fc134b9d999be2c285ef64d8dbe0f381fdfcf8eaf7c30408d887ab962a4c813e7240aeac6202ca921dc90be5a8bffbfbeff5510c6b9ad8cc12a43dfb74aae1de3966bd08384dc8daf341543242cdd6ca8d24693c79fbb3ad6f794cda8f9b6388dab7eb183d42b9553cc76573febd5a326a0b8b3bf7483aec4ba53a3168a886060ce2559e5030bcda56bc45af744971711c0a78610cde795e2c12335fe37123027808e71012f9f01d541cb3bd41f372fad3090957109c86944"}}, &(0x7f00000001c0)) timer_settime(r4, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:18 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:18 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060ac26000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:18 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000020fff0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:18 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x7000000}) 00:01:18 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r4, 0x1, &(0x7f0000000100)={{0x0, 0x989680}}, 0x0) timer_settime(r4, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 493.182992][T14608] loop5: detected capacity change from 0 to 4 [ 493.208633][T14608] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 493.221248][T14614] loop4: detected capacity change from 0 to 4 00:01:19 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 493.321560][T14614] EXT4-fs (loop4): bad geometry: block count 16715522 exceeds size of device (2 blocks) [ 493.360877][T14608] loop5: detected capacity change from 0 to 4 00:01:19 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r4, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:19 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x8000000}) 00:01:19 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002feff0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:19 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_settime(0x0, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 493.373211][T14608] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 493.388880][T14614] loop4: detected capacity change from 0 to 4 [ 493.408824][T14614] EXT4-fs (loop4): bad geometry: block count 16715522 exceeds size of device (2 blocks) [ 493.516258][T14659] loop4: detected capacity change from 0 to 4 [ 493.526241][T14659] EXT4-fs (loop4): bad geometry: block count 16776706 exceeds size of device (2 blocks) [ 493.536789][T14658] loop0: detected capacity change from 0 to 1028 [ 493.584090][T14659] loop4: detected capacity change from 0 to 4 [ 493.603366][T14659] EXT4-fs (loop4): bad geometry: block count 16776706 exceeds size of device (2 blocks) 00:01:19 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) getpeername$unix(0xffffffffffffffff, &(0x7f0000000240), &(0x7f0000000040)=0x6e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x4000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 00:01:19 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060ad26000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:19 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:19 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_settime(0x0, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:19 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x9000000}) 00:01:19 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000020000002e000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:19 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_settime(0x0, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 494.005974][T14686] loop4: detected capacity change from 0 to 4 [ 494.015804][T14686] EXT4-fs (loop4): can't read group descriptor 0 [ 494.028148][T14689] loop0: detected capacity change from 0 to 1028 [ 494.050395][T14686] loop4: detected capacity change from 0 to 4 [ 494.101108][T14686] EXT4-fs (loop4): can't read group descriptor 0 [ 494.107531][ C1] print_req_error: 177 callbacks suppressed [ 494.107547][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 494.128363][T14697] loop5: detected capacity change from 0 to 4 00:01:19 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r4, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 494.141182][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 494.152587][ C1] buffer_io_error: 162 callbacks suppressed [ 494.152604][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 494.153917][T14697] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 494.185704][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 00:01:19 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xa000000}) [ 494.196863][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 494.208101][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 494.219379][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 494.227822][T14695] loop0: unable to read partition table [ 494.228132][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 494.234492][T14695] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 494.244566][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 494.267918][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 494.279043][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 494.288134][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 00:01:20 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200020019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 494.299498][ C1] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:20 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 494.325735][T14697] loop5: detected capacity change from 0 to 4 [ 494.331886][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 494.342931][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 494.351745][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 494.362762][ C1] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:20 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = epoll_create1(0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r1, r2, &(0x7f0000000100)=0x10001, 0x4) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r3, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 494.384430][T14697] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 494.402896][T14724] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=2) [ 494.427713][T14730] loop4: detected capacity change from 0 to 4 [ 494.450339][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 494.452290][T14730] EXT4-fs (loop4): bad geometry: block count 131074 exceeds size of device (2 blocks) [ 494.461373][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 494.481583][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 494.566757][T14738] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=2) [ 494.593023][T14730] loop4: detected capacity change from 0 to 4 [ 494.603122][T14730] EXT4-fs (loop4): bad geometry: block count 131074 exceeds size of device (2 blocks) 00:01:20 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) epoll_create1(0x0) syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:20 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060008f000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:20 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:20 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = epoll_create1(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_mcast\x00') sendfile(r2, r3, &(0x7f0000000100)=0x10001, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r4, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:20 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xb000000}) 00:01:20 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200030019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:20 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) epoll_create1(0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:20 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) preadv(r1, &(0x7f00000002c0)=[{&(0x7f0000000040)=""/30, 0x1e}, {&(0x7f0000000140)}, {&(0x7f0000000240)=""/20, 0x14}, {&(0x7f0000000280)=""/18, 0x12}], 0x4, 0xffff, 0x4) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) [ 494.891255][T14754] loop0: detected capacity change from 0 to 1028 [ 494.924197][T14763] loop4: detected capacity change from 0 to 4 [ 494.930567][T14760] loop5: detected capacity change from 0 to 4 00:01:20 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 494.962220][T14760] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 494.975414][T14763] EXT4-fs (loop4): bad geometry: block count 196610 exceeds size of device (2 blocks) [ 494.996765][T14768] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=1) 00:01:20 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xc000000}) 00:01:20 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200040019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:20 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 495.025076][T14760] loop5: detected capacity change from 0 to 4 [ 495.042928][T14760] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:20 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006000c7000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:20 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 495.120632][T14793] loop0: detected capacity change from 0 to 1028 00:01:20 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:20 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 495.201431][T14806] loop5: detected capacity change from 0 to 4 [ 495.227901][T14806] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 495.237383][T14802] loop4: detected capacity change from 0 to 4 00:01:21 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060feff000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:21 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xd000000}) [ 495.260549][T14802] EXT4-fs (loop4): bad geometry: block count 262146 exceeds size of device (2 blocks) 00:01:21 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 495.308466][T14824] loop5: detected capacity change from 0 to 4 [ 495.316288][T14824] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 495.336816][T14802] loop4: detected capacity change from 0 to 4 [ 495.367707][T14802] EXT4-fs (loop4): bad geometry: block count 262146 exceeds size of device (2 blocks) [ 495.393057][T14824] loop5: detected capacity change from 0 to 4 [ 495.422983][T14824] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:22 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:22 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:22 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200050019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:22 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600102000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:22 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xe000000}) 00:01:22 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:22 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r0, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 496.363321][T14867] loop4: detected capacity change from 0 to 4 [ 496.375639][T14872] loop0: detected capacity change from 0 to 1028 [ 496.384393][T14871] loop5: detected capacity change from 0 to 4 00:01:22 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200060019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:22 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r0, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 496.457145][T14867] EXT4-fs (loop4): bad geometry: block count 327682 exceeds size of device (2 blocks) [ 496.492729][T14871] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) exit_group(0x0) 00:01:22 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:22 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xf000000}) 00:01:22 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r0, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 496.622750][T14871] loop5: detected capacity change from 0 to 4 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) exit_group(0x0) 00:01:22 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600103000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:22 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) exit_group(0x0) [ 496.663268][T14871] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 496.676123][T14910] loop4: detected capacity change from 0 to 4 [ 496.689019][T14910] EXT4-fs (loop4): bad geometry: block count 393218 exceeds size of device (2 blocks) 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:22 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200070019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:22 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:22 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 496.798511][T14945] loop4: detected capacity change from 0 to 4 [ 496.807441][T14945] EXT4-fs (loop4): bad geometry: block count 458754 exceeds size of device (2 blocks) [ 496.833835][T14957] loop5: detected capacity change from 0 to 4 [ 496.861873][T14957] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 496.867338][T14945] loop4: detected capacity change from 0 to 4 00:01:22 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x10000000}) 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:22 executing program 0: r0 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:22 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600104000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:22 executing program 0: r0 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:22 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200080019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 496.914694][T14945] EXT4-fs (loop4): bad geometry: block count 458754 exceeds size of device (2 blocks) [ 496.928294][T14957] loop5: detected capacity change from 0 to 4 [ 496.935857][T14957] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:22 executing program 0: r0 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:22 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 497.046482][T15008] loop4: detected capacity change from 0 to 4 [ 497.052888][T15007] loop5: detected capacity change from 0 to 4 [ 497.056526][T15008] EXT4-fs (loop4): bad geometry: block count 524290 exceeds size of device (2 blocks) [ 497.073179][T14998] loop0: detected capacity change from 0 to 1028 [ 497.086727][T15007] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 497.124158][T15008] loop4: detected capacity change from 0 to 4 [ 497.156855][T15008] EXT4-fs (loop4): bad geometry: block count 524290 exceeds size of device (2 blocks) [ 497.172229][T14979] loop0: unable to read partition table [ 497.178488][T14979] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 497.206650][T15034] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) 00:01:22 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:22 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600105000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:22 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:22 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:22 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x11000000}) 00:01:22 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200090019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:23 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:23 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:23 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 497.335001][T15056] loop4: detected capacity change from 0 to 4 00:01:23 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:23 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x12000000}) 00:01:23 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 497.452020][T15061] loop5: detected capacity change from 0 to 4 [ 497.458402][T15056] EXT4-fs (loop4): bad geometry: block count 589826 exceeds size of device (2 blocks) [ 497.504258][T15061] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 497.517387][T15056] loop4: detected capacity change from 0 to 4 [ 497.538462][T15056] EXT4-fs (loop4): bad geometry: block count 589826 exceeds size of device (2 blocks) 00:01:23 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:23 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600106000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:23 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:23 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:23 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002000a0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:23 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 497.551050][T15061] loop5: detected capacity change from 0 to 4 [ 497.557793][T15061] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 497.567169][T15092] loop0: detected capacity change from 0 to 1028 00:01:23 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:23 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:23 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:23 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x20000000}) 00:01:23 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:23 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 497.660817][T15108] loop4: detected capacity change from 0 to 4 [ 497.690678][T15108] EXT4-fs (loop4): bad geometry: block count 655362 exceeds size of device (2 blocks) [ 497.714323][T15123] loop5: detected capacity change from 0 to 4 [ 497.756928][T15123] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 497.769852][T15108] loop4: detected capacity change from 0 to 4 [ 497.799532][T15108] EXT4-fs (loop4): bad geometry: block count 655362 exceeds size of device (2 blocks) [ 497.813180][T15123] loop5: detected capacity change from 0 to 4 [ 497.820385][T15123] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:23 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:23 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:23 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:23 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002000b0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:23 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600107000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:23 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x25000000}) [ 497.896843][T15150] loop0: detected capacity change from 0 to 1028 00:01:23 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:23 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 497.961061][T15184] loop4: detected capacity change from 0 to 4 [ 497.971118][T15184] EXT4-fs (loop4): bad geometry: block count 720898 exceeds size of device (2 blocks) [ 497.989380][T15193] loop5: detected capacity change from 0 to 4 00:01:23 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:23 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 498.008578][T15191] loop0: detected capacity change from 0 to 1028 [ 498.024383][T15193] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 498.024580][T15184] loop4: detected capacity change from 0 to 4 00:01:23 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 498.073976][T15184] EXT4-fs (loop4): bad geometry: block count 720898 exceeds size of device (2 blocks) [ 498.088771][T15193] loop5: detected capacity change from 0 to 4 00:01:23 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002000c0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 498.147807][T15193] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 498.165703][T15195] loop0: unable to read partition table [ 498.178988][T15195] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) 00:01:24 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:24 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x3f000000}) 00:01:24 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:24 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, 0x0, 0x0, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:24 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600108000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 498.202057][T15229] loop4: detected capacity change from 0 to 4 [ 498.226483][T15229] EXT4-fs (loop4): bad geometry: block count 786434 exceeds size of device (2 blocks) [ 498.278305][T15229] loop4: detected capacity change from 0 to 4 [ 498.293528][T15229] EXT4-fs (loop4): bad geometry: block count 786434 exceeds size of device (2 blocks) 00:01:24 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002000d0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:24 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:24 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, 0x0, 0x0, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:24 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 498.360029][T15256] loop5: detected capacity change from 0 to 4 [ 498.383315][T15256] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:24 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:24 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, 0x0, 0x0, 0xd9f, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:24 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 498.475394][T15273] loop4: detected capacity change from 0 to 4 [ 498.475394][T15256] loop5: detected capacity change from 0 to 4 00:01:24 executing program 3: r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:24 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x40000000}) 00:01:24 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:24 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600109000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:24 executing program 3: r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 498.516957][T15256] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 498.532370][T15273] EXT4-fs (loop4): bad geometry: block count 851970 exceeds size of device (2 blocks) [ 498.589912][T15273] loop4: detected capacity change from 0 to 4 00:01:24 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002000e0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:24 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:24 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:24 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x48000000}) 00:01:24 executing program 3: r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:24 executing program 3: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 498.636822][T15273] EXT4-fs (loop4): bad geometry: block count 851970 exceeds size of device (2 blocks) [ 498.662901][T15323] loop5: detected capacity change from 0 to 4 [ 498.671379][T15323] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:24 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, 0x0, &(0x7f0000000080)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:24 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060010a000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 498.717636][T15323] loop5: detected capacity change from 0 to 4 [ 498.731211][T15323] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:24 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:24 executing program 3: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 498.788817][T15354] loop4: detected capacity change from 0 to 4 [ 498.803104][T15354] EXT4-fs (loop4): bad geometry: block count 917506 exceeds size of device (2 blocks) 00:01:24 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:24 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 498.862994][T15354] loop4: detected capacity change from 0 to 4 [ 498.869727][T15369] loop5: detected capacity change from 0 to 4 [ 498.899961][T15354] EXT4-fs (loop4): bad geometry: block count 917506 exceeds size of device (2 blocks) 00:01:24 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002000f0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:24 executing program 3: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:24 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x4c000000}) 00:01:24 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) [ 498.923358][T15369] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 498.933960][T15346] loop0: detected capacity change from 0 to 1028 00:01:24 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060010b000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 498.976626][T15386] loop_set_status: loop0 () has still dirty pages (nrpages=1) 00:01:24 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, 0x0, &(0x7f0000000080)) timer_settime(0x0, 0x1, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:24 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 499.017307][T15386] loop_set_status: loop0 () has still dirty pages (nrpages=1) [ 499.045711][T15402] loop4: detected capacity change from 0 to 4 00:01:24 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:24 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, 0x0, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f00000003c0)={{}, {0x77359400}}, &(0x7f0000000400)) 00:01:24 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 499.074168][T15402] EXT4-fs (loop4): bad geometry: block count 983042 exceeds size of device (2 blocks) [ 499.082340][T15410] loop0: detected capacity change from 0 to 1028 [ 499.109630][T15421] loop5: detected capacity change from 0 to 4 [ 499.136627][T15420] loop_set_status: loop0 () has still dirty pages (nrpages=1) [ 499.152509][T15402] loop4: detected capacity change from 0 to 4 00:01:24 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, 0x0, &(0x7f0000000080)) timer_settime(0x0, 0x0, 0x0, &(0x7f0000000400)) 00:01:24 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 499.196575][T15410] loop_set_status: loop0 () has still dirty pages (nrpages=9) [ 499.210218][T15421] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 499.223786][T15402] EXT4-fs (loop4): bad geometry: block count 983042 exceeds size of device (2 blocks) 00:01:25 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200100019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:25 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 499.274445][ C1] print_req_error: 109 callbacks suppressed [ 499.274459][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 499.314754][T15421] loop5: detected capacity change from 0 to 4 [ 499.326352][T15421] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 499.337077][T15441] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 499.356140][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 499.367333][ C1] buffer_io_error: 106 callbacks suppressed [ 499.367349][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 499.381539][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 499.392745][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 499.400843][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 00:01:25 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x68000000}) 00:01:25 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, 0x0, &(0x7f0000000080)) timer_settime(0x0, 0x0, 0x0, &(0x7f0000000400)) 00:01:25 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:25 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060010c000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 499.412043][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 499.418497][T15463] loop4: detected capacity change from 0 to 4 [ 499.419934][T15420] loop0: unable to read partition table [ 499.431911][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 499.442992][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 499.445272][T15463] EXT4-fs (loop4): bad geometry: block count 1048578 exceeds size of device (2 blocks) 00:01:25 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 499.452628][T15420] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 499.473499][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 499.484508][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 499.493797][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 499.504727][ C1] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:25 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200110019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:25 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 499.513596][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 499.524652][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 499.538652][T15463] loop4: detected capacity change from 0 to 4 [ 499.545478][T15463] EXT4-fs (loop4): bad geometry: block count 1048578 exceeds size of device (2 blocks) [ 499.559011][T15473] loop5: detected capacity change from 0 to 4 00:01:25 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, 0x0, &(0x7f0000000080)) timer_settime(0x0, 0x0, 0x0, &(0x7f0000000400)) 00:01:25 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 499.566794][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 499.577797][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 499.594336][T15473] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 499.626663][T15476] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=2) [ 499.646690][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 499.657639][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 499.666696][ C1] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:25 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:25 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, 0x0, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f00000003c0)={{}, {0x77359400}}, 0x0) 00:01:25 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x6c000000}) 00:01:25 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060010d000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 499.679526][T15473] loop5: detected capacity change from 0 to 4 [ 499.693180][T15473] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 499.704552][T15502] loop4: detected capacity change from 0 to 4 00:01:25 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, 0x0, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f00000003c0)={{}, {0x77359400}}, 0x0) 00:01:25 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:25 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, 0x0, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f00000003c0)={{}, {0x77359400}}, 0x0) [ 499.745248][T15502] EXT4-fs (loop4): bad geometry: block count 1114114 exceeds size of device (2 blocks) [ 499.777432][T15491] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=2) 00:01:25 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:25 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:25 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) timer_create(0x0, 0x0, &(0x7f0000000080)) timer_settime(0x0, 0x0, 0x0, &(0x7f0000000400)) 00:01:25 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200120019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:25 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x74000000}) [ 499.824367][T15502] loop4: detected capacity change from 0 to 4 [ 499.837981][T15523] loop5: detected capacity change from 0 to 4 [ 499.844336][T15502] EXT4-fs (loop4): bad geometry: block count 1114114 exceeds size of device (2 blocks) [ 499.858963][T15523] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:25 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:25 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002000d0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:25 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060010e000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 499.943021][T15523] loop5: detected capacity change from 0 to 4 [ 499.969914][T15523] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:25 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:25 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 500.043567][T15561] loop4: detected capacity change from 0 to 4 00:01:25 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d5", 0xd2}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:25 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 500.086958][T15561] EXT4-fs (loop4): bad geometry: block count 1179650 exceeds size of device (2 blocks) [ 500.099685][T15573] loop5: detected capacity change from 0 to 4 [ 500.116284][T15573] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:25 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:25 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:25 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x7a000000}) 00:01:25 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200220019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:25 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060010f000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:25 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d5", 0xd2}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 500.152216][T15561] loop4: detected capacity change from 0 to 4 [ 500.159064][T15573] loop5: detected capacity change from 0 to 4 [ 500.165321][T15561] EXT4-fs (loop4): bad geometry: block count 1179650 exceeds size of device (2 blocks) [ 500.165619][T15573] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:25 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d5", 0xd2}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:26 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:26 executing program 0: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000000, 0x110, 0xffffffffffffffff, 0x6951a000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) timer_settime(r1, 0x0, &(0x7f0000000100)={{r2, r3+10000000}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000280)={0x0, 0x8014}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r5, 0x0) preadv(r5, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(r5, &(0x7f0000000000)='./file0\x00', 0x82, 0x9) r6 = syz_mount_image$msdos(&(0x7f00000002c0), &(0x7f0000000300)='./file0\x00', 0x5, 0xa, &(0x7f0000000880)=[{&(0x7f0000000340)="26055aefc44b0e8ab300acd93a6675a3d2bde33faaa47e169818e3fc8f0a26fc05aa50701a8fc9908a9a25f12bad8f47cd8e2c159007833582d664720e8d5bba80bfa700f5cdf29d0e7e63a79cb30ad326906f2bdab6b4ab395ff61a31a33e15777dfcea017d3c17133ed8043a7cc2373c6a2c07c8c3fbc97c75f8463a6d7b6a8ef40ce0fe765118c9e8f29451974f88a12a911d239b99c1877ef855788041c7dd56ed3e11456efe18ab79ec872cb37f17737b4b9c664c6169da28566713a4", 0xbf, 0x7}, {&(0x7f0000000400), 0x0, 0xea}, {&(0x7f0000000440)="345e06543d38", 0x6, 0xe65}, {&(0x7f0000000480)="3bb13d14d67c4661defff05838216579d95e0af3cb4e7417c87dc98bab40bccb96be1d42c30e17123ea0d05b520b698765dedd1bebc2ce9ec0ac0228e3a697c8d1a01c73d6848326cccedbe6a25773c14665032299c7de061c7b0d9f17e4e33d76c409f5dd20da67459e801ba3cf4b9811670ec809cbbcce78d1518944f16ec7f5ece2283e071881612809b951b80858c2af5ce30fb3bc044d7971958c91e856d1cd81f9cacc6491877981304fb6ce631ca9b558f42b71825c736a21b4495a8c296d4463dc46c808e91dc496687e60c6608e5b72b0d61f41e87265ca7b124db092b630dc9de1f60259671ad4dc897759b4f2271a74f7a6523a15aec832c7ab", 0xff, 0x101}, {&(0x7f0000000580), 0x0, 0x5}, {&(0x7f00000005c0)="2dd7c7ea49c0a2f723f900c6c5d361d894418aafc498cf38fe15c14f4f1000a35ab5aba77b19ce5b97fff6d3ca9be542381b7cd308bef5d8d7eb8cf1ff12b3d9781bee957d843c808ab8cd9aded92c097ee66d5fd9d11343db693a7151f72ea17f22120778bf7dd3f8cec9a0104201cc0bbf17c2fd8d55d94681797e2bc4aa671299b3d021d3e2852f1a790c05495bde045e6c00ccfd9f7d4d8fe89f63c13a20302460f9978ad14f9a145eddf33edd1188e4dc51b64dc21d0e91dbd712bd68542d", 0xc1, 0x10001}, {&(0x7f00000006c0)="4914dec70bbc753dde8b45732d133754264a6905f8d584edfde238a460dcc07ecf5f600e4905e2e8a8ff0718ea48be1b22074219ca16335d0c61a9740e87174924", 0x41, 0xffffffffffff0000}, {&(0x7f0000000740)="5b0610f63ba479b34d001558abb405fb61fe1b9a68efeaa5b724a434c827daa3ff07ca26f6a81ce6", 0x28, 0xffffffffffffff8e}, {&(0x7f0000000780)="1b129764744cacb3152959036bfacb9e5f8aa925d3ff3fa6e3ddf0612b27462a0b5933c51d92b3fa373d3f54ca87d69011999e24f31cac8832ea9c33adc05cf39af383a162d15c7338b3b626a6", 0x4d, 0x6}, {&(0x7f0000000800)="ae5dbc1d256a618e9a94dca69ac89d87b647a57797f42d56d7b864399438947981c3897623f0f2a55a81099096e0e3651b032c2f491a94e31b7656155c9c4b036597cf647f2599c19bf9303261b0c6bcd7fbee4ea6516ff7ad0409f26439ff", 0x5f, 0x7}], 0x2002006, &(0x7f0000000980)={[{@dots}, {@fat=@codepage={'codepage', 0x3d, '737'}}, {@nodots}, {@fat=@uid={'uid', 0x3d, 0xffffffffffffffff}}, {@nodots}, {@nodots}], [{@fscontext={'fscontext', 0x3d, 'unconfined_u'}}, {@hash}, {@subj_user={'subj_user', 0x3d, 'cpuacct.usage_percpu_sys\x00'}}]}) openat(r6, &(0x7f0000000a00)='./file0\x00', 0x51b800, 0x4) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f0000000140)) 00:01:26 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 500.295253][T15619] loop5: detected capacity change from 0 to 4 00:01:26 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200250019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:26 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0x97ffffff}) [ 500.357983][T15623] loop4: detected capacity change from 0 to 4 [ 500.359303][T15619] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 500.373875][T15623] EXT4-fs (loop4): bad geometry: block count 2228226 exceeds size of device (2 blocks) 00:01:26 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:26 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:26 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 500.413023][T15619] loop5: detected capacity change from 0 to 4 [ 500.428439][T15619] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 500.495138][T15659] loop0: detected capacity change from 0 to 1028 00:01:26 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600110000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:26 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666", 0xa6}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:26 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xcf511b04}) [ 500.586566][T15668] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=6) [ 500.618175][T15665] loop4: detected capacity change from 0 to 4 00:01:26 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666", 0xa6}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:26 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666", 0xa6}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 500.639321][T15665] EXT4-fs (loop4): bad geometry: block count 2424834 exceeds size of device (2 blocks) [ 500.667467][T15685] loop5: detected capacity change from 0 to 4 [ 500.697757][T15685] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 500.799657][T15665] loop4: detected capacity change from 0 to 4 [ 500.810251][T15665] EXT4-fs (loop4): bad geometry: block count 2424834 exceeds size of device (2 blocks) [ 500.838318][T15697] loop0: detected capacity change from 0 to 1028 00:01:26 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:26 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63", 0xc2}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:26 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:26 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xfdfdffff}) 00:01:26 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002002e0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:26 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600111000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63", 0xc2}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:27 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200480019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63", 0xc2}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 501.311379][T15739] loop4: detected capacity change from 0 to 4 [ 501.319483][T15742] loop5: detected capacity change from 0 to 4 [ 501.324857][T15738] loop0: detected capacity change from 0 to 1028 [ 501.327606][T15739] EXT4-fs (loop4): bad geometry: block count 3014658 exceeds size of device (2 blocks) [ 501.343556][T15742] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f2", 0xd0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) exit_group(0x0) 00:01:27 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 501.392896][T15742] loop5: detected capacity change from 0 to 4 [ 501.400506][T15742] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 501.451748][T15738] loop0: detected capacity change from 0 to 1028 [ 501.471459][T15786] loop4: detected capacity change from 0 to 4 [ 501.481118][T15786] EXT4-fs (loop4): bad geometry: block count 4718594 exceeds size of device (2 blocks) 00:01:27 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xfdffffff}) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f2", 0xd0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600112000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) exit_group(0x0) [ 501.536661][T15786] loop4: detected capacity change from 0 to 4 [ 501.560852][T15797] loop0: unable to read partition table [ 501.566583][T15797] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) 00:01:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) exit_group(0x0) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f2", 0xd0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002004c0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 501.575275][T15786] EXT4-fs (loop4): bad geometry: block count 4718594 exceeds size of device (2 blocks) [ 501.591646][T15808] loop5: detected capacity change from 0 to 4 [ 501.598444][ T1033] loop0: unable to read partition table [ 501.599428][T15808] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d581", 0xd7}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d581", 0xd7}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600122000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 501.650466][T15808] loop5: detected capacity change from 0 to 4 [ 501.661435][T15817] loop0: detected capacity change from 0 to 1028 [ 501.669932][T15808] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:27 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xff0f0000}) 00:01:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d581", 0xd7}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 501.737951][T15841] loop4: detected capacity change from 0 to 4 [ 501.775506][T15841] EXT4-fs (loop4): bad geometry: block count 4980738 exceeds size of device (2 blocks) 00:01:27 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048ffffffff", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:27 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200600019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 501.802516][T15863] loop5: detected capacity change from 0 to 4 [ 501.828122][T15868] loop0: detected capacity change from 0 to 1028 00:01:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 501.846864][T15863] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e9", 0xdc}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 501.939950][T15891] loop4: detected capacity change from 0 to 4 [ 501.947572][T15863] loop5: detected capacity change from 0 to 4 [ 501.954292][T15863] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 501.964653][T15891] EXT4-fs (loop4): bad geometry: block count 6291458 exceeds size of device (2 blocks) [ 501.976442][T15885] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=2) 00:01:27 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600125000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xfffffdfd}) 00:01:27 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200680019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e9", 0xdc}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e9", 0xdc}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.091953][T15939] loop4: detected capacity change from 0 to 4 [ 502.095031][T15938] loop5: detected capacity change from 0 to 4 [ 502.120812][T15938] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.133548][T15939] EXT4-fs (loop4): bad geometry: block count 6815746 exceeds size of device (2 blocks) 00:01:27 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060012e000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:27 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xffffff97}) 00:01:27 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048feffffff", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 502.173138][T15939] loop4: detected capacity change from 0 to 4 [ 502.211908][T15938] loop5: detected capacity change from 0 to 4 00:01:27 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002006c0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:27 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:27 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.219761][T15938] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 502.224891][T15939] EXT4-fs (loop4): bad geometry: block count 6815746 exceeds size of device (2 blocks) 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.266978][T15984] loop0: detected capacity change from 0 to 1028 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.367143][T15982] loop5: detected capacity change from 0 to 4 [ 502.375470][T15982] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:28 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600148000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048000200", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.449659][T15982] loop5: detected capacity change from 0 to 4 [ 502.449703][T16015] loop4: detected capacity change from 0 to 4 [ 502.462678][T15982] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 502.463722][T16015] EXT4-fs (loop4): bad geometry: block count 7077890 exceeds size of device (2 blocks) 00:01:28 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xfffffffd}) 00:01:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.488758][T16010] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 502.536502][T16015] loop4: detected capacity change from 0 to 4 [ 502.548425][T16038] loop5: detected capacity change from 0 to 4 [ 502.556300][T16015] EXT4-fs (loop4): bad geometry: block count 7077890 exceeds size of device (2 blocks) [ 502.556738][T16038] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:28 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200740019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.585914][T16048] loop0: detected capacity change from 0 to 1028 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.629184][T16038] loop5: detected capacity change from 0 to 4 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060014c000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 502.676562][T16038] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048000300", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.736461][T16047] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=4) [ 502.757415][T16080] loop4: detected capacity change from 0 to 4 [ 502.776560][T16090] loop5: detected capacity change from 0 to 4 00:01:28 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe], 0xffffffff}) 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.787807][T16090] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 502.800699][T16080] EXT4-fs (loop4): bad geometry: block count 7602178 exceeds size of device (2 blocks) 00:01:28 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002007a0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600160000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.865825][T16080] loop4: detected capacity change from 0 to 4 [ 502.872763][T16080] EXT4-fs (loop4): bad geometry: block count 7602178 exceeds size of device (2 blocks) [ 502.884740][T16108] loop0: detected capacity change from 0 to 1028 00:01:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.913446][T16126] loop5: detected capacity change from 0 to 4 [ 502.931014][T16133] loop4: detected capacity change from 0 to 4 [ 502.937862][T16126] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 502.939656][T16133] EXT4-fs (loop4): bad geometry: block count 7995394 exceeds size of device (2 blocks) [ 502.957662][T16097] loop_set_status: loop0 () has still dirty pages (nrpages=2) 00:01:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048000400", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 502.996468][T16108] loop_set_status: loop0 () has still dirty pages (nrpages=1) [ 503.022201][T16126] loop5: detected capacity change from 0 to 4 [ 503.031057][T16126] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 503.063916][T16133] loop4: detected capacity change from 0 to 4 [ 503.083251][T16108] loop0: detected capacity change from 0 to 1028 00:01:28 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000280)={0x5, 0x80, 0x3, 0x1f, 0x1, 0x4, 0x0, 0xfffffffffffffffa, 0x0, 0x6, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x5, 0x1, @perf_bp={&(0x7f0000000040), 0x2}, 0x0, 0xcec, 0x5, 0x9, 0x5, 0x1, 0x9, 0x0, 0x4, 0x0, 0xffffffffffff63c1}, 0xffffffffffffffff, 0x6, r3, 0x9) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:28 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600168000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200fe0019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 503.109602][T16133] EXT4-fs (loop4): bad geometry: block count 7995394 exceeds size of device (2 blocks) [ 503.136531][T16155] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=2) 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:28 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 503.201585][T16186] loop4: detected capacity change from 0 to 4 [ 503.209659][T16186] EXT4-fs (loop4): bad geometry: block count 16646146 exceeds size of device (2 blocks) [ 503.219997][T16181] loop5: detected capacity change from 0 to 4 [ 503.228360][T16155] loop0: unable to read partition table [ 503.234130][T16155] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 503.248604][T16181] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048000500", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:29 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060016c000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:29 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/crypto\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200b20119000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 503.296397][T16189] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) 00:01:29 executing program 0: r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 0: r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 503.400033][T16225] loop5: detected capacity change from 0 to 4 [ 503.412221][T16233] loop4: detected capacity change from 0 to 4 [ 503.426526][T16225] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:29 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000280)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000300)=[{&(0x7f0000000380)="a2efda5406485192c63e85389b719a2a7dcd1c469da0335c3b94fb2e42274da581dc9f502fcf32c46335056ed073f4316a4f226667b3aa7c04c7ac33fe15cb07f97ad3270fb7487ef9a48f442639b53b7682f0613b15e279625724f3ce35941e1171eaca448531d9b6981d097f802877ee8e2841bf715c3439139c7e180a6099dd8ba6653b28d85f5592a8362dafbc379f4285ff2f10e689dedab0ad53fad59c01c750d9addc17", 0xa7}, {&(0x7f0000000040)="cfe7e6059197aa3d97f79b753d", 0xd}, {&(0x7f0000000440)="cd394f266571cb3abf0848625ae2160b1bc5ca4b669968a1683c4615a2f71eea36b9d5c9dc5988abcdac885a9bde2d9972e210f5b261e84a34606168043397e10b50da5c1f8dd4521d24b1abf91542261dce3369c738d305a4a7d7d34afa61d7c3b94c8b4850a26142c4c714ddd68ef6be2e2198c8f0bc04e6d1a88adc247c54699ec100a787158459ac29eb599455cdbad07548042d144c251d2544930df97b4148be5cebc113aa7daa5649441a422b7d26a4e8d14390eadc74fc9305bee03a404eb9bc3101eb1a192b8f72944abf5e", 0xd0}, {&(0x7f0000000540)="d8b91de1263dfbc39ba088325ba7c615f4ca75099b9662cb19826582b7a2ad240ada3e18affca13711668ac7882810aa9853c5f8b71349ea1fd360eaf0f03469b2084e93c48a6f2d00e066eb8f3c800f402c5c16de237867667403d1306d990114aafed9ad9ad757d0a96cade5ac89facd79fe00afc8996af124c216fa3ae428ec69365a767be32ae36d55a592f9b545df69d708e09c6bcdacf740983c1386ea8bd6cffb521cebae0bcc6fd93e17964cce61a9932dae7a63a2cbd8987fed6176ac8203d14d81f418da1019ecc086cfe84cefa71deea12c6576d65a4b7fb4dcb95986698e30f01b4b89a57fae3e5ac04ef28e5220", 0xf4}], 0x4, &(0x7f0000000b00)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYRES32=0x0, @ANYBLOB="0000000034000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32=r2, @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32, @ANYRES32=r3, @ANYRES32=r2, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYRES32=0x0, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32=r2, @ANYRES32=r3, @ANYRES32, @ANYRES32, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32, @ANYRES32=r0, @ANYRES32=r3, @ANYBLOB="0010041900000000000000000100000001000600", @ANYRES32=r0, @ANYRES32=r2, @ANYRES32=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32=r0, @ANYRES32, @ANYRES32=r2], 0x108, 0x40040}, 0x40804) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:29 executing program 0: r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 503.446622][T16233] EXT4-fs (loop4): bad geometry: block count 28442626 exceeds size of device (2 blocks) [ 503.486966][T16225] loop5: detected capacity change from 0 to 4 [ 503.493724][T16225] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 503.509388][T16258] loop0: detected capacity change from 0 to 1028 [ 503.532009][T16233] loop4: detected capacity change from 0 to 4 00:01:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048000600", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600174000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:29 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200b30119000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 503.544908][T16233] EXT4-fs (loop4): bad geometry: block count 28442626 exceeds size of device (2 blocks) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x2, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 503.627826][T16285] loop5: detected capacity change from 0 to 4 [ 503.635936][T16285] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 503.659986][T16295] loop4: detected capacity change from 0 to 4 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048000700", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:29 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060017a000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 503.673934][T16295] EXT4-fs (loop4): bad geometry: block count 28508162 exceeds size of device (2 blocks) [ 503.697828][T16285] loop5: detected capacity change from 0 to 4 [ 503.704415][T16285] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 503.774829][T16295] loop4: detected capacity change from 0 to 4 [ 503.795349][T16295] EXT4-fs (loop4): bad geometry: block count 28508162 exceeds size of device (2 blocks) 00:01:29 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200d00119000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 503.827381][T16345] loop5: detected capacity change from 0 to 4 [ 503.835582][T16345] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 503.877326][T16345] loop5: detected capacity change from 0 to 4 [ 503.884400][T16345] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 503.901390][T16310] loop0: detected capacity change from 0 to 1028 00:01:29 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048000800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2000000, 0x10, r0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:29 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001fe000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 503.938247][T16372] loop4: detected capacity change from 0 to 4 [ 503.949035][T16372] EXT4-fs (loop4): bad geometry: block count 30408706 exceeds size of device (2 blocks) 00:01:29 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200040219000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 504.014523][T16387] loop5: detected capacity change from 0 to 4 [ 504.023613][T16387] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048000900", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:29 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060013b010ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 504.098733][T16406] loop4: detected capacity change from 0 to 4 [ 504.110967][T16406] EXT4-fs (loop4): bad geometry: block count 33816578 exceeds size of device (2 blocks) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002002f0219000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:29 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:29 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 504.185090][T16406] loop4: detected capacity change from 0 to 4 [ 504.204799][T16406] EXT4-fs (loop4): bad geometry: block count 33816578 exceeds size of device (2 blocks) [ 504.212707][T16431] loop5: detected capacity change from 0 to 4 00:01:30 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 504.263770][T16431] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 504.293834][T16458] loop4: detected capacity change from 0 to 4 00:01:30 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048000a00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:30 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060013c010ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 504.315807][T16431] loop5: detected capacity change from 0 to 4 [ 504.320221][T16458] EXT4-fs (loop4): bad geometry: block count 36634626 exceeds size of device (2 blocks) [ 504.331132][T16431] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:30 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002004c0219000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 504.433584][T16491] loop5: detected capacity change from 0 to 4 00:01:30 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 504.475230][T16491] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048000b00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:30 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 504.532134][T16504] loop4: detected capacity change from 0 to 4 [ 504.544642][T16491] loop5: detected capacity change from 0 to 4 [ 504.559510][T16504] EXT4-fs (loop4): bad geometry: block count 38535170 exceeds size of device (2 blocks) [ 504.577214][T16491] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:30 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060013d010ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:30 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002004d0219000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 504.658678][T16504] loop4: detected capacity change from 0 to 4 [ 504.670046][T16504] EXT4-fs (loop4): bad geometry: block count 38535170 exceeds size of device (2 blocks) 00:01:30 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048000c00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 504.830919][T16552] loop4: detected capacity change from 0 to 4 [ 504.844379][T16555] loop5: detected capacity change from 0 to 4 [ 504.853868][T16552] EXT4-fs (loop4): bad geometry: block count 38600706 exceeds size of device (2 blocks) 00:01:30 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 504.919873][T16555] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:30 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000080)) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000000380)={"d70340a999bb6515e4b8ab1d0771dad7", 0x0, 0x0, {0xff, 0x5}, {0x7f, 0x3}, 0xffff, [0x2, 0xdc, 0x1, 0x3f, 0xff, 0xccc, 0x0, 0x463, 0x5, 0x81, 0x5, 0x9, 0x10001, 0x2, 0x7ff, 0xe6de]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) splice(r2, &(0x7f0000000040)=0x41, 0xffffffffffffffff, &(0x7f0000000280)=0x100, 0x93, 0x8) 00:01:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048000d00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:30 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000319000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:30 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)='M', 0x1}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 505.021973][T16552] loop4: detected capacity change from 0 to 4 [ 505.037111][T16552] EXT4-fs (loop4): bad geometry: block count 38600706 exceeds size of device (2 blocks) [ 505.073880][T16555] loop5: detected capacity change from 0 to 4 [ 505.097591][T16555] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 505.110472][T16606] loop4: detected capacity change from 0 to 4 00:01:30 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600104020ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:30 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)='M', 0x1}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b608370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe00", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 505.119080][T16606] EXT4-fs (loop4): bad geometry: block count 50331650 exceeds size of device (2 blocks) 00:01:30 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)='M', 0x1}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048000e00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 505.180438][T16606] loop4: detected capacity change from 0 to 4 00:01:30 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:30 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200c10319000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:30 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 505.223204][T16606] EXT4-fs (loop4): bad geometry: block count 50331650 exceeds size of device (2 blocks) [ 505.241547][T16633] loop0: detected capacity change from 0 to 1028 00:01:31 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:31 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:31 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 505.295103][T16648] loop5: detected capacity change from 0 to 4 [ 505.309688][T16648] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 505.325490][T16663] loop4: detected capacity change from 0 to 4 [ 505.333911][T16633] loop0: detected capacity change from 0 to 1028 [ 505.355422][T16663] EXT4-fs (loop4): bad geometry: block count 62980098 exceeds size of device (2 blocks) [ 505.386353][T16662] loop_set_status: loop0 () has still dirty pages (nrpages=2) [ 505.414481][T16663] loop4: detected capacity change from 0 to 4 [ 505.423336][T16648] loop5: detected capacity change from 0 to 4 [ 505.433177][T16648] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 505.445867][T16663] EXT4-fs (loop4): bad geometry: block count 62980098 exceeds size of device (2 blocks) 00:01:31 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001c2020ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:31 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:31 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048001000", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:31 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) r2 = getpgrp(0xffffffffffffffff) r3 = pidfd_open(r2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) pidfd_getfd(r3, r4, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r5 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r5, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x6fff, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x64b2ff41db6b1857) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r6, 0x0) preadv(r6, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) dup3(r1, r0, 0x80000) 00:01:31 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b", 0x38}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:31 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200020419000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:31 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:31 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b", 0x38}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:31 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 505.547620][T16702] loop4: detected capacity change from 0 to 4 [ 505.564861][T16702] EXT4-fs (loop4): bad geometry: block count 67239938 exceeds size of device (2 blocks) [ 505.575535][T16712] loop5: detected capacity change from 0 to 4 00:01:31 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200060419000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:31 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) exit_group(0x0) 00:01:31 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000304000/0x1000)=nil, 0x1000, 0x1800003, 0x100010, r3, 0xf7557000) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000280)=""/102, 0x66}, {&(0x7f0000000380)=""/82, 0x52}], 0x2, 0x9, 0xffff) [ 505.617347][T16712] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 505.637312][T16702] loop4: detected capacity change from 0 to 4 [ 505.649607][T16702] EXT4-fs (loop4): bad geometry: block count 67239938 exceeds size of device (2 blocks) [ 505.693850][T16712] loop5: detected capacity change from 0 to 4 [ 505.707634][T16712] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 505.729370][T16750] loop4: detected capacity change from 0 to 4 00:01:31 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001c3020ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:31 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b", 0x38}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:31 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048001100", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:31 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) exit_group(0x0) 00:01:31 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000519000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 505.758604][T16750] EXT4-fs (loop4): bad geometry: block count 67502082 exceeds size of device (2 blocks) 00:01:31 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73f4e946", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) exit_group(0x0) 00:01:31 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xe5', 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000040)=0x10000) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000300)=0x0) perf_event_open(&(0x7f0000000280)={0x3, 0x80, 0x1, 0x0, 0x34, 0xfa, 0x0, 0x8, 0x4, 0x2, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x401, 0x1, @perf_config_ext={0x0, 0x6}, 0x84e, 0x8000, 0x7, 0x6, 0x1f, 0x6, 0x1, 0x0, 0x4, 0x0, 0x600}, r4, 0x9, r0, 0x9) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:31 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) r2 = getpgrp(0xffffffffffffffff) r3 = pidfd_open(r2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) pidfd_getfd(r3, r4, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r5 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r5, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x6fff, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x64b2ff41db6b1857) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r6, 0x0) preadv(r6, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) dup3(r1, r0, 0x80000) 00:01:31 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644", 0x54}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 505.843812][T16771] loop5: detected capacity change from 0 to 4 [ 505.846090][T16772] loop4: detected capacity change from 0 to 4 [ 505.852132][T16771] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 505.859725][T16772] EXT4-fs (loop4): bad geometry: block count 83886082 exceeds size of device (2 blocks) 00:01:31 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644", 0x54}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048ffffffff", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:31 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000619000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:31 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001c4020ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 505.943150][T16772] loop4: detected capacity change from 0 to 4 [ 505.950321][T16771] loop5: detected capacity change from 0 to 4 [ 505.958322][T16771] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 505.975905][T16772] EXT4-fs (loop4): bad geometry: block count 83886082 exceeds size of device (2 blocks) 00:01:31 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644", 0x54}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 505.988238][T16806] loop0: detected capacity change from 0 to 1028 00:01:31 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048001200", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:31 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca3", 0x62}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:31 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:31 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca3", 0x62}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 506.121147][ C0] print_req_error: 41 callbacks suppressed [ 506.121165][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 506.130922][T16828] loop5: detected capacity change from 0 to 4 [ 506.148215][T16830] loop4: detected capacity change from 0 to 4 [ 506.163733][T16828] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 506.168739][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 506.184500][ C0] buffer_io_error: 38 callbacks suppressed [ 506.184519][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 506.199749][T16830] EXT4-fs (loop4): bad geometry: block count 100663298 exceeds size of device (2 blocks) 00:01:31 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0xff, 0x9, 0x7, 0x0, "afb7c3fdd6e28545540cd73d78b6e422e6614684923c26b472f9994281e7bf3c102eb879450e496e723f1b7b75909411c776d9ec675928d26ada20a1fb903ca1", "9a6b507d297eab5f49a7b7afe4989f167e8cc844933e51841877177ff44825ed", [0xff, 0x6]}) 00:01:31 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:31 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca3", 0x62}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:31 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:32 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100030ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 506.226319][T16824] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 506.243521][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 506.254726][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 506.316352][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 506.327962][ C1] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:32 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200040619000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:32 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048002500", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:32 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b8", 0x69}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:32 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) exit_group(0x0) 00:01:32 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001c1030ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 506.359348][T16866] loop5: detected capacity change from 0 to 4 [ 506.375598][T16866] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 506.385018][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 506.396267][ C1] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:32 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b8", 0x69}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:32 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) exit_group(0x0) [ 506.417502][T16858] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 506.432806][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 506.444006][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 506.453558][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 506.464489][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 506.476708][T16875] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=2) [ 506.509422][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 506.520463][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 506.523382][T16890] loop4: detected capacity change from 0 to 4 [ 506.542470][T16890] EXT4-fs (loop4): bad geometry: block count 100925442 exceeds size of device (2 blocks) 00:01:32 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) exit_group(0x0) [ 506.551314][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 506.563651][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 506.586293][T16875] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 506.598936][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 00:01:32 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_bp={0x0}, 0x1004, 0x0, 0x0, 0x2, 0x800000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x3) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d4449f6c", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000348000/0x3000)=nil, 0x3000, 0x44fadee7ea79b9e3, 0x10, 0xffffffffffffffff, 0x4d271000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:32 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b8", 0x69}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 506.609944][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 506.619735][T16901] loop5: detected capacity change from 0 to 4 [ 506.626063][T16890] loop4: detected capacity change from 0 to 4 [ 506.648559][T16890] EXT4-fs (loop4): bad geometry: block count 100925442 exceeds size of device (2 blocks) 00:01:32 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:32 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 506.659546][T16901] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 506.669536][ C1] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:32 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000719000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:32 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:32 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:32 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 506.726692][ T1033] loop0: unable to read partition table [ 506.747995][T16901] loop5: detected capacity change from 0 to 4 [ 506.754648][T16901] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:32 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:32 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600102040ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:32 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:32 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 506.780677][T16933] loop4: detected capacity change from 0 to 4 [ 506.810044][T16933] EXT4-fs (loop4): bad geometry: block count 117440514 exceeds size of device (2 blocks) 00:01:32 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048004c00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:32 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600106040ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:32 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) r4 = syz_open_dev$vcsa(&(0x7f0000000040), 0x7, 0x200480) ioctl$LOOP_SET_STATUS(r4, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:32 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 506.867873][T16933] loop4: detected capacity change from 0 to 4 [ 506.884657][T16933] EXT4-fs (loop4): bad geometry: block count 117440514 exceeds size of device (2 blocks) [ 506.898888][T16951] loop5: detected capacity change from 0 to 4 [ 506.907488][T16951] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:32 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000919000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:32 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:32 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1", 0x6e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:32 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048006800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:32 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1", 0x6e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:32 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 507.004392][T16975] loop0: detected capacity change from 0 to 1028 [ 507.028413][T16987] loop5: detected capacity change from 0 to 4 00:01:32 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:32 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1", 0x6e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 507.069439][T17001] loop4: detected capacity change from 0 to 4 [ 507.075154][T16987] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 507.089135][T17001] EXT4-fs (loop4): bad geometry: block count 150994946 exceeds size of device (2 blocks) 00:01:32 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x2, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x380000c, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f000029a000/0x4000)=nil, 0x4000, 0x0, 0x4008013, r4, 0x20944000) preadv(r3, &(0x7f0000000280), 0x1000000000000128, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x20d9f, 0x5) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x1, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba88b4b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "01000009000004000000008f696b61b991d9b5a4d70000000000000000000001", [0x2, 0x2]}) [ 507.151712][T17000] loop0: unable to read partition table [ 507.157403][T17001] loop4: detected capacity change from 0 to 4 [ 507.158982][T17000] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 507.164416][T16987] loop5: detected capacity change from 0 to 4 [ 507.188621][T17001] EXT4-fs (loop4): bad geometry: block count 150994946 exceeds size of device (2 blocks) 00:01:33 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100050ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:33 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000a19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:33 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048006c00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:33 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000280)) [ 507.245137][T16987] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 507.261733][T17034] loop0: detected capacity change from 0 to 1028 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 507.326715][T17053] loop4: detected capacity change from 0 to 4 [ 507.340045][T17053] EXT4-fs (loop4): bad geometry: block count 167772162 exceeds size of device (2 blocks) 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x403, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) write(r2, &(0x7f0000000040)="e7629b477010ff8a58ef9dc8bf3af8573b36f5cc92c19b6020abd8677f721ef77db74631357db40f1136c1", 0x2b) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x0, 0x10001, 0x6) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 507.420955][T17053] loop4: detected capacity change from 0 to 4 [ 507.427889][T17063] loop5: detected capacity change from 0 to 4 [ 507.460891][T17053] EXT4-fs (loop4): bad geometry: block count 167772162 exceeds size of device (2 blocks) [ 507.477836][T17063] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 507.517181][T17094] loop0: detected capacity change from 0 to 1028 00:01:33 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100060ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000b19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:33 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048007400", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:33 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0xe1, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x1, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x28]}) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x7ffffffd, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)={0x200100, 0x4}, 0x18) r4 = openat(r3, &(0x7f0000000040)='/proc/self/exe\x00', 0x400, 0x169) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) dup3(r1, r0, 0x80000) [ 507.578430][T17063] loop5: detected capacity change from 0 to 4 [ 507.584966][T17063] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x0, 0x377}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x3, 0x10, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$F2FS_IOC_GARBAGE_COLLECT(0xffffffffffffffff, 0x4004f506, &(0x7f0000000040)) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 507.678633][T17128] loop4: detected capacity change from 0 to 4 [ 507.687958][T17128] EXT4-fs (loop4): bad geometry: block count 184549378 exceeds size of device (2 blocks) 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 507.785198][T17144] loop0: detected capacity change from 0 to 1028 [ 507.791893][T17128] loop4: detected capacity change from 0 to 4 [ 507.834605][T17128] EXT4-fs (loop4): bad geometry: block count 184549378 exceeds size of device (2 blocks) [ 507.837603][T17133] loop5: detected capacity change from 0 to 4 [ 507.857379][T17133] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:33 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600104060ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:33 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd204204484800020000070000000048007a00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:33 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000c19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:33 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x8382) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x5, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0xd9f, 0x1d80) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x60000000, 0x6, 0x20, 0x1a, "3f6726c85b1b2eaf47fe1e44a0fc233ad7edc424e50006eee95c3f0707c6df583eb9e507642147cdb0c2da6efd9092e595ce36b475d0ca6617e73bc2d12a2a49", "bab3fb276fec21f7eda171fc9044661bff78f963dd0a694132fc88ddf30960fe", [0x100, 0x3]}) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x1) mmap(&(0x7f00002ca000/0x2000)=nil, 0x2000, 0x80000e, 0x50, r3, 0x0) preadv(r1, &(0x7f0000000040), 0x0, 0x2000d9d, 0x3f) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x10000806, 0x0, 0xa, 0x9, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b609ed59fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a42ca50fa338dae25c520c00", [0x0, 0x5]}) [ 507.913935][T17133] loop5: detected capacity change from 0 to 4 [ 507.920759][T17133] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 508.022979][T17193] loop4: detected capacity change from 0 to 4 [ 508.046062][T17202] loop5: detected capacity change from 0 to 4 00:01:33 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000005c0)={0x0, {}, 0x0, {}, 0x7, 0x12, 0x800c, 0x0, "5b6e29272030675658a3edcda2bf189513d61d4796c07a6a60c48e0a829fb97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e00", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0xf4a, 0x4]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = syz_mount_image$iso9660(&(0x7f0000000280), &(0x7f00000002c0)='./file0\x00', 0x400000000000, 0x4, &(0x7f00000004c0)=[{&(0x7f0000000380)="e2b8eb7f2c9d279fbd1f04a146d2ac33452ce197c5da021ed121c3ff0f0030f2093fd35952db5f973872f08ebb180759ffa7c0f6f1ebc3faa06b876e7670eab670de43508741b57f256eb761832b66ecd8844d0cbbf0c10761959b72925ca65f8c2c66862e95e638039a05535e1211034076865485e0cb", 0x77, 0x8001}, {&(0x7f0000000400)="35bb3bc0a919c35e74530a986645211a414fac916c4fa117a10111b174e089b6ebc911af4de1461882d8e705ef55a5b1ec69d724e4f11b95d4774903c9f42b265e85410af5811b198802f8f6e78a7d1c1d66f6fe5c70048520a23485b3933332149046eb70bb33a50735581efe1843a9b28a88c07acf7fa9", 0x78, 0x4}, {&(0x7f0000000300)="9b8c84cfef7dd58d16e0fce0bad9fa1e6db2af0c078cea2e5d044bb9b8ea0146c415eea04ec0593936318a87e84d18b81a3eca10bf344325115a09a662", 0x3d, 0x9}, {&(0x7f0000000480)="1cdf07736f31dc6ccf06", 0xa, 0x10000}], 0x204c08, &(0x7f0000000540)={[{@map_off}, {@nocompress}, {@dmode={'dmode', 0x3d, 0x40}}, {@uid={'uid', 0x3d, 0xffffffffffffffff}}], [{@subj_user={'subj_user', 0x3d, '}:$(/#'}}, {@fowner_lt={'fowner<', 0xee01}}, {@dont_appraise}]}) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) preadv(r3, &(0x7f0000000280), 0x0, 0xd9f, 0x3) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r6 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r6, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 508.073294][T17202] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 508.084054][T17193] EXT4-fs (loop4): bad geometry: block count 201326594 exceeds size of device (2 blocks) 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800fe00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:33 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100070ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:33 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000d19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 508.137597][T17202] loop5: detected capacity change from 0 to 4 [ 508.139117][T17193] loop4: detected capacity change from 0 to 4 [ 508.164652][T17193] EXT4-fs (loop4): bad geometry: block count 201326594 exceeds size of device (2 blocks) [ 508.174918][T17202] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:33 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:34 executing program 3: r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 508.237306][T17236] loop0: detected capacity change from 0 to 1028 [ 508.251946][T17236] loop2: detected capacity change from 0 to 264192 [ 508.260219][T17256] loop5: detected capacity change from 0 to 4 [ 508.269418][T17257] loop4: detected capacity change from 0 to 4 [ 508.286222][T17256] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:34 executing program 3: r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:34 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100090ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 508.337617][T17254] loop0: unable to read partition table [ 508.346299][T17257] EXT4-fs (loop4): bad geometry: block count 218103810 exceeds size of device (2 blocks) [ 508.359780][T17254] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 508.386210][T17236] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 508.412602][T17257] loop4: detected capacity change from 0 to 4 [ 508.415356][T17286] loop5: detected capacity change from 0 to 4 [ 508.420460][T17257] EXT4-fs (loop4): bad geometry: block count 218103810 exceeds size of device (2 blocks) 00:01:34 executing program 3: r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:34 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000e19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 508.429260][T17286] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 508.456836][T17236] loop0: detected capacity change from 0 to 1028 [ 508.466511][T17290] loop2: detected capacity change from 0 to 264192 00:01:34 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800040200", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:34 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000731000/0x3000)=nil, 0x3000, 0x0, 0x50, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x8, 0x12, 0xd, 0xd, "6328b0a012152232bdf0fab95411c78aef548f269a1fe1a91542677f6baebbe8cd92a44feb381615783fa54eb829cff2938557f70fb428a0ebb90696f9f4e8f3", "b8cb753bc6195ac08dbcb7572cf95e424abe5ee94c77867419b9d4a330d6f442", [0x718000000000, 0xaabf]}) 00:01:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 508.522365][T17286] loop5: detected capacity change from 0 to 4 00:01:34 executing program 3: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 508.562746][T17286] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:34 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001000a0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:34 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000f19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 508.630675][T17320] loop4: detected capacity change from 0 to 4 [ 508.643752][T17320] EXT4-fs (loop4): bad geometry: block count 234881026 exceeds size of device (2 blocks) 00:01:34 executing program 3: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:34 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000040)='.-\x00') ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 508.819858][T17342] loop5: detected capacity change from 0 to 4 [ 508.831509][T17342] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 508.833379][T17356] loop4: detected capacity change from 0 to 4 [ 508.852942][T17358] loop0: detected capacity change from 0 to 1028 00:01:34 executing program 3: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 508.862864][T17356] EXT4-fs (loop4): bad geometry: block count 251658242 exceeds size of device (2 blocks) [ 508.875899][T17342] loop5: detected capacity change from 0 to 4 00:01:34 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r4 = perf_event_open$cgroup(&(0x7f0000000280)={0x2, 0x80, 0x81, 0x0, 0xff, 0x3, 0x0, 0x8, 0x10, 0xb, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x6, 0x4, @perf_config_ext={0x3f, 0x6}, 0x400, 0x5, 0x0, 0x5, 0x800, 0x50a2, 0x4, 0x0, 0x0, 0x0, 0xe3a}, r3, 0xc, 0xffffffffffffffff, 0x9) preadv(r4, 0x0, 0x0, 0xda7, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:34 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000300", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:34 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001000b0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 508.954430][T17342] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 508.969858][T17356] loop4: detected capacity change from 0 to 4 00:01:34 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200201019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:34 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 509.029238][T17356] EXT4-fs (loop4): bad geometry: block count 251658242 exceeds size of device (2 blocks) [ 509.067616][T17403] loop5: detected capacity change from 0 to 4 00:01:34 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:34 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 509.078701][T17400] loop0: detected capacity change from 0 to 1028 [ 509.095843][T17403] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 509.151280][T17423] loop4: detected capacity change from 0 to 4 [ 509.157746][T17403] loop5: detected capacity change from 0 to 4 [ 509.169349][T17423] EXT4-fs (loop4): bad geometry: block count 270532610 exceeds size of device (2 blocks) 00:01:34 executing program 2: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r4, 0x0) preadv(r4, &(0x7f00000001c0)=[{0x0}], 0x1, 0x9, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x114031, 0xffffffffffffffff, 0x0) getsockopt$inet_int(r3, 0x0, 0x21, 0x0, &(0x7f0000000180)) 00:01:34 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800020400", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:34 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200001119000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:34 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001000c0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:34 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:34 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 509.196633][ T1033] loop0: unable to read partition table [ 509.204024][T17403] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 509.282934][T17445] loop0: detected capacity change from 0 to 1028 [ 509.306838][T17461] loop4: detected capacity change from 0 to 4 [ 509.313309][T17470] loop5: detected capacity change from 0 to 4 [ 509.327268][ T1033] loop0: unable to read partition table 00:01:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f000002c000/0x1000)=nil, 0x1000, 0x100000d, 0x12, r2, 0xe4300000) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, 0x3, 0x2, 0x101, 0x0, 0x0, {0x1}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x44041}, 0x800) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 509.334058][T17447] loop0: unable to read partition table [ 509.335657][T17470] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 509.341219][T17447] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 509.349652][T17461] EXT4-fs (loop4): bad geometry: block count 285212674 exceeds size of device (2 blocks) 00:01:35 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800060400", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 509.434987][T17487] loop0: detected capacity change from 0 to 1028 [ 509.447092][T17470] loop5: detected capacity change from 0 to 4 [ 509.455100][T17461] loop4: detected capacity change from 0 to 4 [ 509.467227][T17470] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 509.467268][T17461] EXT4-fs (loop4): bad geometry: block count 285212674 exceeds size of device (2 blocks) 00:01:35 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200001219000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:35 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001000d0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 509.603953][T17536] loop5: detected capacity change from 0 to 4 [ 509.627041][T17536] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 509.637069][T17537] loop4: detected capacity change from 0 to 4 [ 509.637540][T17540] loop0: detected capacity change from 0 to 1028 [ 509.657207][T17537] EXT4-fs (loop4): bad geometry: block count 301989890 exceeds size of device (2 blocks) 00:01:35 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000500", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:35 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200002019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001000e0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0xa, 0x1f, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) r2 = memfd_create(&(0x7f0000000040)='.^\xc5', 0x1) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x400000, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 509.768211][T17536] loop5: detected capacity change from 0 to 4 [ 509.774878][T17536] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000600", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 509.856405][T17589] loop4: detected capacity change from 0 to 4 [ 509.866614][T17590] loop5: detected capacity change from 0 to 4 [ 509.871123][T17589] EXT4-fs (loop4): bad geometry: block count 536870914 exceeds size of device (2 blocks) [ 509.894341][T17590] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:35 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r3, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x1d3, 0x5, 0x19, 0x10, "e2b8a1c261f3915fcc12025f91d8c3debb72edb35bc9338babf57d4756a961a55b6d38fdd8db50609c973575676277188beb9e1cd07a4ad56e8058c8de5bf519", "b316d4fc77c9b3671ea4e755beef8aa2bc615f3aea4e51467c8bda8375b8d26b", [0xffffffffffffffff, 0x8]}) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 509.928041][T17589] loop4: detected capacity change from 0 to 4 [ 509.943334][T17589] EXT4-fs (loop4): bad geometry: block count 536870914 exceeds size of device (2 blocks) [ 509.959895][T17590] loop5: detected capacity change from 0 to 4 [ 509.967338][T17590] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:35 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200102019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001000f0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800040600", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171", 0x6d}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 510.065693][T17646] loop0: detected capacity change from 0 to 1028 [ 510.074658][T17658] loop4: detected capacity change from 0 to 4 [ 510.085713][T17659] loop5: detected capacity change from 0 to 4 00:01:35 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171", 0x6d}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 510.123673][T17658] EXT4-fs (loop4): bad geometry: block count 537919490 exceeds size of device (2 blocks) [ 510.138714][T17659] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:35 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:35 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171", 0x6d}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 510.196683][T17659] loop5: detected capacity change from 0 to 4 [ 510.220960][T17658] loop4: detected capacity change from 0 to 4 [ 510.232257][T17659] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 510.248366][T17658] EXT4-fs (loop4): bad geometry: block count 537919490 exceeds size of device (2 blocks) 00:01:36 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200002219000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:36 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600120100ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000700", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:36 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) r1 = syz_open_dev$vcsu(&(0x7f0000000000), 0x418, 0x10000) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r2) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x7fffffff, 0x0, 0x12, 0x8, "4b904d11d0c143475c43e0d0a3e3ea4c7f4cc84f32c5dc25149a5386eb66eec1d47e6cd05a41b7e01b9ae9f1b8a2758014850b49f90bdf8d8eb556f663f957de", "a30a6ab94522e7cfc97247ff922210ae7f692d81202c3fa35b699d1a5ceb3205", [0x5, 0x3]}) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000000040)={[0x7]}, 0x8) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) ioctl$LOOP_CLR_FD(r1, 0x4c01) 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348", 0xa4}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348", 0xa4}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40082404, &(0x7f0000000340)) r2 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000003c0)={0x0, {}, 0x0, {}, 0x1, 0x0, 0xa, 0x15, "869631d527eda32143bda573e21e907e59665e2844b45c3c86b5ae50e4d33b0a06723840da021188baee47331ec6d8a527769386b25aeec19b1f424b8ea4bce3", "0965ccbe67c03d8399ca719bf41b27561d341d13ea9ba4a57541697b3abd96df", [0x5, 0x10001]}) r3 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r3, &(0x7f0000000080)=[{&(0x7f0000000040)="4a14f30f6380b3c117c1ea2ada757fd71b5353833eaedb791a65af119541"}, {&(0x7f0000000280)="7c079d045a39b6712055d1f036d3628eaac79bd62b4bfcc680ecd0ff1279280bfa208da250f806565416473572a9606bdd382dea59eb4ab614ce1189cd72baca98a1a6a6a554edf60cf7c4d2098b3c4fa6d569dd01182f2fc37df1b41b5a5fb0bee184b68f584c8d3eb344f5d4", 0xfffffffffffffeba}], 0x10000000000000eb, 0x80807, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r2, 0x4c00, r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x15, 0x10000, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r2, 0x4c02, 0x0) r5 = dup3(r2, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 510.402380][T17725] loop4: detected capacity change from 0 to 4 [ 510.416878][T17725] EXT4-fs (loop4): bad geometry: block count 570425346 exceeds size of device (2 blocks) [ 510.431681][T17728] loop5: detected capacity change from 0 to 4 00:01:36 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200002519000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348", 0xa4}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000900", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 510.448952][T17728] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:36 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100110ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772", 0xbf}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 510.525077][T17728] loop5: detected capacity change from 0 to 4 [ 510.538590][T17728] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 510.556820][T17761] loop4: detected capacity change from 0 to 4 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772", 0xbf}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 510.576696][T17761] EXT4-fs (loop4): bad geometry: block count 620756994 exceeds size of device (2 blocks) [ 510.615359][T17786] loop5: detected capacity change from 0 to 4 00:01:36 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000a00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:36 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x101) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772", 0xbf}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 510.634154][T17761] loop4: detected capacity change from 0 to 4 [ 510.655810][T17761] EXT4-fs (loop4): bad geometry: block count 620756994 exceeds size of device (2 blocks) [ 510.673241][T17786] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:36 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200002e19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a7038", 0xcd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a7038", 0xcd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 510.754824][T17786] loop5: detected capacity change from 0 to 4 00:01:36 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600112110ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:36 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000b00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a7038", 0xcd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee", 0xd4}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 510.806436][T17786] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 510.818702][T17830] loop4: detected capacity change from 0 to 4 [ 510.845515][T17830] EXT4-fs (loop4): bad geometry: block count 771751938 exceeds size of device (2 blocks) 00:01:36 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="446cfa318bc328828475ec401d70b1ecee93eea582a85d470b6099de68211598c652a5483520411b33b02844ed7cd452c2603eda6ef34d2f4bb05a7ee68a22199120d755c3bc696d86d8672b3db3791f32187c1cdd3a75", 0x57}, {&(0x7f0000000480)="8fdc99dda3450cd6f07828104719a3de7254c75ed6d0731423fa83f1e477be011a1d224dd70402f9d5dc72cacea74444ddb27de6da5a0f056dda28ec7d6b530eebc33d1f3bdf539880a4387f7034b7c69dfca17e8f87caa84636ff15eea9ad4947cac15110c4703422e73848f5485fd82c2d70e1b8e1986c61dff17fdc8492e16c9c9fd0b25f3c9bca225cc74e2b7b05dbb8197230bffcaa3a4b00000dae646eb5bb9838", 0xa4}], 0x2, 0x80804, 0xe10) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000000300)=0x4, 0x8001) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) pwritev(r0, &(0x7f0000000580)=[{&(0x7f0000000380)="d2eef5d4b9d547b83712c155e3b2e461ee96ed2083d406f9ea71d5b755daa98db9dc7ef43546c0f52249701a1b648bc62a7049aa00b2e134d40b2197256c7ef0f73615edb543b17d4e9953a5a50aef8c437fe3f492ff5973e7818287ddd8139b253afd16bb60610522d0b7a4919ad037900e215300e66284abfa7f2b7fe3aeade7a0832f9c6b2fd1a0995d530b35db021d9ef24a7bee8c4e7034a4e6ad2f740edb79fe71515dd5d9a8920896432990847e26fb490bc5dc2c5856d8a95d1a6ad235f852907b89c5c4bfd4f488", 0xcc}, {&(0x7f0000000780)="d8510fb76886ad34cc5fbd4b7b9f7668355efcdc9e21c451bfb758529c3b4d90769c2bf32f52b4489ea81c90893cd9d80e25dc9c3500c6b5b65f2c59d3108f3cb2ab69b0da63cec00af1b2507ee7faa8445d7001be3fdddca88cbdfdc901e07d3b5efb5b0454390b35724b03fdf4d1640afad33a588a50807cbec20f78ea0e078f65c62c90a905e30ddd303c3bae393e5a698398e8e7ada61e44e12f7a6f41c118cd7e7119d8c6286acd8611496ccb3ebefc44f3bc07c5e24534a24cfbaae3dbe3490978f9a31734886a5d262624bc654c2d4e3c3faeae7c40330ef5ae5eed1d51c45c4482995ed0977a", 0xea}, {&(0x7f00000005c0)="9c4ea4ea69c5cf7399c52633313141c626ab7857b7bfd7f643c386aa4b0b96d421a2433fe197052907bf0d01e828afcec8cfa95d1c2bf71008c278ffbfe013f852947915ceb7667f23c570d3803d1d25be55e575a7b5a4171695ff569b058dfdf44f272cb77ce41ff652afc0fe211a13ccf6d796264f4f6c996b6453a210ed005e7e741b333ed2ba24e7c4c703a92bde7b9c7e000000", 0x96}], 0x3, 0x7, 0x1) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(0xffffffffffffffff, r2, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee", 0xd4}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 510.888103][T17851] loop5: detected capacity change from 0 to 4 [ 510.895965][T17851] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 510.916487][T17830] loop4: detected capacity change from 0 to 4 [ 510.923484][T17830] EXT4-fs (loop4): bad geometry: block count 771751938 exceeds size of device (2 blocks) 00:01:36 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200022f19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100120ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 510.943441][T17851] loop5: detected capacity change from 0 to 4 [ 510.951080][T17851] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 511.008676][T17871] loop0: detected capacity change from 0 to 1028 [ 511.027563][T17887] loop4: detected capacity change from 0 to 4 [ 511.035072][T17890] loop5: detected capacity change from 0 to 4 [ 511.050116][T17867] loop0: unable to read partition table 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee", 0xd4}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 511.052983][T17890] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 511.061862][T17867] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 511.083321][T17887] EXT4-fs (loop4): bad geometry: block count 788660226 exceeds size of device (2 blocks) 00:01:36 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000c00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:36 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) r4 = accept4$packet(r3, 0x0, &(0x7f0000000040), 0x0) ioctl$LOOP_SET_FD(r3, 0x4c00, r4) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:36 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600111120ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d581", 0xd7}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)='M', 0x1}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:36 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d581", 0xd7}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 511.169036][T17887] loop4: detected capacity change from 0 to 4 [ 511.187788][T17887] EXT4-fs (loop4): bad geometry: block count 788660226 exceeds size of device (2 blocks) [ 511.201981][T17927] loop5: detected capacity change from 0 to 4 [ 511.211036][T17927] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:36 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200003f19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:37 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)='M', 0x1}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d581", 0xd7}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 511.247773][T17927] loop5: detected capacity change from 0 to 4 00:01:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa", 0xd9}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:37 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000d00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:37 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100200ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 511.298929][T17927] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 511.322749][T17954] loop4: detected capacity change from 0 to 4 [ 511.330850][T17954] EXT4-fs (loop4): bad geometry: block count 1056964610 exceeds size of device (2 blocks) 00:01:37 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)='M', 0x1}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa", 0xd9}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:37 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) r3 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0xfffffffffffffffb) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r3, 0x8008f511, &(0x7f0000000040)) fcntl$F_GET_FILE_RW_HINT(r3, 0x40d, &(0x7f0000000280)) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0xfe8c}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 511.386965][T17954] loop4: detected capacity change from 0 to 4 [ 511.393733][T17954] EXT4-fs (loop4): bad geometry: block count 1056964610 exceeds size of device (2 blocks) 00:01:37 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa", 0xd9}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:37 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200004019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 511.468190][T17979] loop5: detected capacity change from 0 to 4 00:01:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 511.509410][T17979] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 511.514413][T17989] loop0: detected capacity change from 0 to 1155 [ 511.567376][T17979] loop5: detected capacity change from 0 to 4 [ 511.588968][T18004] loop4: detected capacity change from 0 to 4 [ 511.601051][T17979] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:37 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_CHANGE_FD(r4, 0x4c06, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x3, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:37 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000e00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:37 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 511.618320][T18004] EXT4-fs (loop4): bad geometry: block count 1073741826 exceeds size of device (2 blocks) [ 511.638496][ C1] print_req_error: 149 callbacks suppressed [ 511.638514][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 511.662870][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 511.674231][ C1] buffer_io_error: 144 callbacks suppressed [ 511.674244][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 511.688809][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 511.699734][ C0] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:37 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600110200ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:37 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 511.716059][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 511.727023][ C0] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:37 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200004819000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 511.771323][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 511.782772][ C0] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 511.811767][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 511.822821][ C0] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:37 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 511.856030][T18033] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 511.868273][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 511.879492][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 511.897425][T18047] loop4: detected capacity change from 0 to 4 00:01:37 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800001100", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 511.914917][T18042] loop5: detected capacity change from 0 to 4 [ 511.923746][T18042] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 511.934261][T18047] EXT4-fs (loop4): bad geometry: block count 1207959554 exceeds size of device (2 blocks) [ 511.947300][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 00:01:37 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x1}, 0x0, 0x1d8, 0x0, 0x2, 0x4000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) preadv(r3, &(0x7f0000000040), 0x0, 0xd9f, 0x0) mmap(&(0x7f0000190000/0x1000)=nil, 0x1000, 0x415b1f1178ed483a, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 511.958243][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 511.966895][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 511.978076][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 511.990236][T18042] loop5: detected capacity change from 0 to 4 [ 511.996712][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 512.007883][ C0] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:37 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 512.028147][T18047] loop4: detected capacity change from 0 to 4 [ 512.043490][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 512.056346][T18042] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 512.066334][T18047] EXT4-fs (loop4): bad geometry: block count 1207959554 exceeds size of device (2 blocks) 00:01:37 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100220ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:37 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:37 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) mmap(&(0x7f00003f2000/0x3000)=nil, 0x3000, 0x2800007, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:37 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200004c19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:37 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) exit_group(0x0) 00:01:37 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800001200", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:37 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) exit_group(0x0) 00:01:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 512.221493][T18098] loop5: detected capacity change from 0 to 4 [ 512.233230][T18098] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 512.255216][T18115] loop4: detected capacity change from 0 to 4 00:01:38 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) exit_group(0x0) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 512.276729][T18116] loop0: detected capacity change from 0 to 1028 [ 512.290018][T18098] loop5: detected capacity change from 0 to 4 [ 512.299815][T18115] EXT4-fs (loop4): bad geometry: block count 1275068418 exceeds size of device (2 blocks) 00:01:38 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x0, 0xa, 0xe, 0x0, "9be95245ac917ff3a1a8e1564a03616163adef29d14379034a4b531222b9e38aebeef545cb6fea10bf0bdb2b3855314b2d0c842f7bd2b36df23fed56ce6a1a5e", "f64de15c3fa18743d77d70d0f892f94e0d2a5a3809bdbb9f839d1e209fc344ae", [0x6, 0x61a1879e]}) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 512.328565][T18098] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 512.340238][T18131] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=2) [ 512.368290][T18115] loop4: detected capacity change from 0 to 4 00:01:38 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100250ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:38 executing program 0: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) mmap(&(0x7f00003f2000/0x3000)=nil, 0x3000, 0x2800007, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 512.389475][T18115] EXT4-fs (loop4): bad geometry: block count 1275068418 exceeds size of device (2 blocks) 00:01:38 executing program 0: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) mmap(&(0x7f00003f2000/0x3000)=nil, 0x3000, 0x2800007, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:38 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200024c19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:38 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800002000", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:38 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$KDGKBMETA(0xffffffffffffffff, 0x4b62, &(0x7f0000000040)) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c610837ab2d8e38b498e8d7782a917c33fdc5fe00", "61b991d90c0000000000000000000000000000ea00", [0x2, 0xfffffffffffffffe]}) preadv(r1, &(0x7f0000000040), 0x0, 0x86, 0x6) [ 512.481533][T18170] loop5: detected capacity change from 0 to 4 [ 512.493062][T18170] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 512.502138][T18183] loop4: detected capacity change from 0 to 4 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:38 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x400, 0x180) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x8001, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 512.534644][T18170] loop5: detected capacity change from 0 to 4 [ 512.549263][T18183] EXT4-fs (loop4): bad geometry: block count 1275199490 exceeds size of device (2 blocks) [ 512.550859][T18170] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 512.564698][T18188] loop0: detected capacity change from 0 to 1028 00:01:38 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001002e0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:38 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2", 0x6f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 512.637706][T18183] loop4: detected capacity change from 0 to 4 [ 512.655957][T18203] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=1) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 512.682071][T18183] EXT4-fs (loop4): bad geometry: block count 1275199490 exceeds size of device (2 blocks) 00:01:38 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200024d19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:38 executing program 0: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000005c0)={0x0, {}, 0x0, {}, 0x7, 0x12, 0x800c, 0x0, "5b6e29272030675658a3edcda2bf189513d61d4796c07a6a60c48e0a829fb97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e00", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0xf4a, 0x4]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = syz_mount_image$iso9660(&(0x7f0000000280), &(0x7f00000002c0)='./file0\x00', 0x400000000000, 0x4, &(0x7f00000004c0)=[{&(0x7f0000000380)="e2b8eb7f2c9d279fbd1f04a146d2ac33452ce197c5da021ed121c3ff0f0030f2093fd35952db5f973872f08ebb180759ffa7c0f6f1ebc3faa06b876e7670eab670de43508741b57f256eb761832b66ecd8844d0cbbf0c10761959b72925ca65f8c2c66862e95e638039a05535e1211034076865485e0cb", 0x77, 0x8001}, {&(0x7f0000000400)="35bb3bc0a919c35e74530a986645211a414fac916c4fa117a10111b174e089b6ebc911af4de1461882d8e705ef55a5b1ec69d724e4f11b95d4774903c9f42b265e85410af5811b198802f8f6e78a7d1c1d66f6fe5c70048520a23485b3933332149046eb70bb33a50735581efe1843a9b28a88c07acf7fa9", 0x78, 0x4}, {&(0x7f0000000300)="9b8c84cfef7dd58d16e0fce0bad9fa1e6db2af0c078cea2e5d044bb9b8ea0146c415eea04ec0593936318a87e84d18b81a3eca10bf344325115a09a662", 0x3d, 0x9}, {&(0x7f0000000480)="1cdf07736f31dc6ccf06", 0xa, 0x10000}], 0x204c08, &(0x7f0000000540)={[{@map_off}, {@nocompress}, {@dmode={'dmode', 0x3d, 0x40}}, {@uid={'uid', 0x3d, 0xffffffffffffffff}}], [{@subj_user={'subj_user', 0x3d, '}:$(/#'}}, {@fowner_lt={'fowner<', 0xee01}}, {@dont_appraise}]}) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) preadv(r3, &(0x7f0000000280), 0x0, 0xd9f, 0x3) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r6 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r6, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 512.756027][T18203] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=1) 00:01:38 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800002500", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:38 executing program 2: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x42004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x12, 0x19, 0x0, "5b6e2995bead1f122716751fa9bf189513d61d4796407a6a60c48e0a8269ae17798a44aad614fac6a21d3dcf083e871587f53cd839f98e00", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x7]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f000054a000/0x3000)=nil, 0x3000, 0x1800003, 0x10, 0xffffffffffffffff, 0xffffe000) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000380)="e16e1a7c1b08c25a28176028c674e786191f6441cb74a359aebc906774048ebaca2e9667627105cf0ef54a9758821205949d4948e36bc3cb1de0a182ec1574ac197db6d67a29f566b8ee2a5ab4201ca607881178ed", 0x55}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r3 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) write$selinux_attr(r3, &(0x7f0000000040)='system_u:object_r:power_device_t:s0\x00', 0x24) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r3, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x7fff, 0x12, 0x1a, 0x1c, "96a78270e94528b45d082c4886d1f98d51021a91b51c927559a604e0beaa23702108f43d6e8d758f1f2c3712588a94a01c9fae72fb64a81c8e6427a0485d2c9a", "5d7d5625480093256032d4417df69350c1d4af1d4e42a79b87a24eeeec30b347", [0x8, 0x5cc]}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000400)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8626467ca463819c0f29effd19e6a42938d7da4f5fbe243336a33fdc1fe000000040200000000000000000000000000000000000000000400", "d236af968170840500dae25c520c000000000000000000000f00", [0x2, 0xfffffffffffffffe]}) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 512.806922][T18243] loop5: detected capacity change from 0 to 4 [ 512.815783][T18243] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:38 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "596e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a8a44aad614fac6a21d3dcf2b3e871587f53cd809f98e00", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 512.849721][T18247] loop4: detected capacity change from 0 to 4 [ 512.866821][T18252] loop0: detected capacity change from 0 to 1028 [ 512.877548][T18247] EXT4-fs (loop4): bad geometry: block count 1291976706 exceeds size of device (2 blocks) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 512.899952][T18243] loop5: detected capacity change from 0 to 4 [ 512.906210][T18252] loop_set_status: loop0 () has still dirty pages (nrpages=1) [ 512.915105][T18243] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:38 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001013b0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:38 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 512.945900][T18262] loop_set_status: loop0 () has still dirty pages (nrpages=2) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:38 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:38 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200006019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:38 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 513.006476][T18247] loop4: detected capacity change from 0 to 4 [ 513.020239][T18247] EXT4-fs (loop4): bad geometry: block count 1291976706 exceeds size of device (2 blocks) [ 513.064952][T18278] loop0: unable to read partition table [ 513.074991][T18278] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 513.091935][T18293] loop5: detected capacity change from 0 to 4 00:01:38 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800003f00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:38 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 513.120884][T18293] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 513.144223][T18311] loop4: detected capacity change from 0 to 4 00:01:38 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x4, 0x23, 0x8, 0x0, 0x0, 0x7a69, 0x40020, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x3, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1f, 0x4, @perf_config_ext, 0x11008, 0xffffffffffff8000, 0xff, 0x5, 0x4, 0xb06, 0xa9, 0x0, 0x8}, 0x0, 0xb, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000300)={&(0x7f0000000040), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, 0x0, 0x8, 0x70bd26, 0x25dfdbfe, {{}, {}, {0x8, 0x2, 0x9}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x4085}, 0x20040810) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 513.165173][T18311] EXT4-fs (loop4): bad geometry: block count 1610612738 exceeds size of device (2 blocks) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:38 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:38 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001013c0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:38 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) exit_group(0x0) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 513.200924][T18293] loop5: detected capacity change from 0 to 4 [ 513.226064][T18293] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 513.323752][T18311] loop4: detected capacity change from 0 to 4 [ 513.346724][T18357] loop5: detected capacity change from 0 to 4 00:01:39 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200006819000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:39 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_CLR_FD(r3, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) exit_group(0x0) 00:01:39 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 513.367427][T18311] EXT4-fs (loop4): bad geometry: block count 1610612738 exceeds size of device (2 blocks) [ 513.381560][T18357] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) exit_group(0x0) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 513.441665][T18357] loop5: detected capacity change from 0 to 4 [ 513.448493][T18357] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:39 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001013d0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 513.511478][T18389] loop4: detected capacity change from 0 to 4 [ 513.546718][T18389] EXT4-fs (loop4): bad geometry: block count 1744830466 exceeds size of device (2 blocks) [ 513.609870][T18413] loop5: detected capacity change from 0 to 4 [ 513.634651][T18389] loop4: detected capacity change from 0 to 4 [ 513.634767][T18413] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 513.641341][T18389] EXT4-fs (loop4): bad geometry: block count 1744830466 exceeds size of device (2 blocks) 00:01:39 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200006c19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:39 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800004c00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7fff, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x40010, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) r4 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$IOC_PR_PREEMPT_ABORT(r4, 0x401870cc, &(0x7f0000000280)={0x8, 0x80000, 0x14611546, 0xfff}) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000380)={0x0, {}, 0x0, {}, 0x1, 0x1, 0x0, 0x8, "ded314584abefa8ef57a5cc0c291e6c2b540ee75fc6321f6cdd10f31b7b6ed83ec1f2a409a8839cfc99b9ec8c30fe09422502e2354849aaddabba6712fe9ccbd", "0d67fdb0aa8f9172de47fdf0355397b3f00a4c578d363a75fc866dee300ebdac", [0x3, 0xffff]}) 00:01:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001003f0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 513.712889][T18413] loop5: detected capacity change from 0 to 4 [ 513.727539][T18413] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 513.773865][T18449] loop0: detected capacity change from 0 to 1028 [ 513.788990][T18453] loop4: detected capacity change from 0 to 4 [ 513.822161][T18451] loop0: unable to read partition table [ 513.827922][T18451] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 513.843269][T18453] EXT4-fs (loop4): bad geometry: block count 1811939330 exceeds size of device (2 blocks) 00:01:39 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r4 = creat(&(0x7f0000000040)='./file0\x00', 0x12a) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x9, 0x0, 0x1a, 0x1, "ce88bf30c022f6a342f016f87628dc0d58e3c1204a0e1ee8b3e599b27348bad3c4c3022ccee05a5e4769e34f180300e6b48c9a34845a8a02ffc9572463b11f62", "950eef0bb86bbd63b373c92074c9cc8dff01b6df66dd0163c4720ad2446f6d62", [0x0, 0x3]}) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) fsetxattr$trusted_overlay_origin(r1, &(0x7f0000000380), &(0x7f00000003c0), 0x2, 0x3) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 513.868460][T18469] loop5: detected capacity change from 0 to 4 [ 513.884430][T18469] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 513.901263][T18453] loop4: detected capacity change from 0 to 4 [ 513.910795][T18453] EXT4-fs (loop4): bad geometry: block count 1811939330 exceeds size of device (2 blocks) 00:01:39 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200007419000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:39 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800006800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100400ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 513.931274][T18469] loop5: detected capacity change from 0 to 4 [ 513.938083][T18469] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='\xfd8\xf2', 0x6) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, 0x0) r3 = dup3(r0, 0xffffffffffffffff, 0x80000) ioctl$LOOP_SET_STATUS(r3, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 514.034125][T18485] loop0: detected capacity change from 0 to 1028 [ 514.046386][T18516] loop5: detected capacity change from 0 to 4 [ 514.063914][T18518] loop4: detected capacity change from 0 to 4 [ 514.070747][T18516] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200007a19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 514.088349][T18518] EXT4-fs (loop4): bad geometry: block count 1946157058 exceeds size of device (2 blocks) 00:01:39 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800006c00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:39 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100480ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:39 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x400, 0x0, 0x0, 0x2, 0x1000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0xf8, 0x3, 0x2, 0x9, "614960662bcdb135bb6e6c2c88d5dc0ebe0778c1f94ce0a6c8f67b119d59a140bf76d8000cad7c0849a46f2856c75d1c7d6582dd0000000200", "191c4ae4129a9dbe74c21fdbaa4b503bce0b7d295f25e4890a84009be057638a", [0x7f, 0xfffffffffffffffe]}) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000380)=[{&(0x7f0000000040)=""/23, 0x17}], 0x1, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) tkill(0xffffffffffffffff, 0x1f) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_CTL(r0, 0x40049421, 0x2) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x3, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x7fffffe, 0xf92e]}) [ 514.140247][T18516] loop5: detected capacity change from 0 to 4 [ 514.156499][T18516] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 514.266099][T18564] loop4: detected capacity change from 0 to 4 [ 514.272493][T18576] loop0: detected capacity change from 0 to 1028 [ 514.286100][T18564] EXT4-fs (loop4): bad geometry: block count 2046820354 exceeds size of device (2 blocks) [ 514.299739][T18577] loop5: detected capacity change from 0 to 4 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r2, 0xc0096616, &(0x7f0000000040)={0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 514.336385][T18577] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 514.355336][T18569] loop0: unable to read partition table [ 514.363360][T18564] loop4: detected capacity change from 0 to 4 [ 514.368538][T18569] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 514.387468][T18564] EXT4-fs (loop4): bad geometry: block count 2046820354 exceeds size of device (2 blocks) [ 514.407197][T18577] loop5: detected capacity change from 0 to 4 [ 514.416150][T18577] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:40 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000020001b219000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800007400", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:40 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001004c0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000311000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 514.554007][T18638] loop4: detected capacity change from 0 to 4 [ 514.573514][T18638] EXT4-fs (loop4): bad geometry: block count 2986409986 exceeds size of device (2 blocks) [ 514.596131][T18652] loop5: detected capacity change from 0 to 4 00:01:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)='M', 0x1}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000020001b319000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:40 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x5, 0x55, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0x9, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BLKPG(r1, 0x1269, &(0x7f0000000300)={0x80000000, 0x1, 0x70, &(0x7f0000000280)="678b4b6f399d66d1d4110662ed2dae2d265160114e1f3086838d148082432c09c4e7bb90bd22ae6ac60358c6818492d6e598402456573aad3a2ade8bdf691c753a9ccf9a7b30ac97d0d6eaf3245f3b1564790aa1bd0dd99b21ac41c9b9268a42f8625b960f505bc11005fe9f4764a8db"}) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 514.622642][T18652] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 514.636648][T18638] loop4: detected capacity change from 0 to 4 [ 514.643326][T18638] EXT4-fs (loop4): bad geometry: block count 2986409986 exceeds size of device (2 blocks) 00:01:40 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800007a00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 514.728411][T18652] loop5: detected capacity change from 0 to 4 [ 514.738825][T18652] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:40 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100600ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)='M', 0x1}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)='M', 0x1}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 514.798481][T18693] loop0: detected capacity change from 0 to 1028 [ 514.798895][T18700] loop4: detected capacity change from 0 to 4 [ 514.828637][T18700] EXT4-fs (loop4): bad geometry: block count 3003187202 exceeds size of device (2 blocks) 00:01:40 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) ioctl$LOOP_CLR_FD(r3, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x0, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 514.845701][T18702] loop_set_status: loop0 () has still dirty pages (nrpages=2) 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 514.874329][T18700] loop4: detected capacity change from 0 to 4 [ 514.882868][T18714] loop5: detected capacity change from 0 to 4 00:01:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000020003c119000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 514.923068][ T1033] loop0: unable to read partition table [ 514.927863][T18714] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 514.941704][T18700] EXT4-fs (loop4): bad geometry: block count 3003187202 exceeds size of device (2 blocks) [ 514.950898][T18702] loop0: unable to read partition table 00:01:40 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800fffe00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 514.966676][T18702] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 515.005161][T18714] loop5: detected capacity change from 0 to 4 [ 515.005645][T18737] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) 00:01:40 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100680ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 515.011904][T18714] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800feff00", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 515.106274][T18764] loop4: detected capacity change from 0 to 4 00:01:40 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:40 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x5) tkill(0x0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 515.179527][T18764] EXT4-fs (loop4): bad geometry: block count 3238199298 exceeds size of device (2 blocks) [ 515.213468][T18788] loop5: detected capacity change from 0 to 4 00:01:41 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000020001d019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:41 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x8, 0xa, 0x1, 0x2, "f38fb29c8b06ce6a85fcf9f708ff86ed176aa20bde90858d084cae3cedb5262b4c31708d0182ad2add9c15d64a9e5ceb55314296a062e40f2886b9a9df72b0b9", "2c3cfc2c8048091f67d3512ed9ec15b5cae0ecff8b33e38b089ee202dd0c824e", [0x800, 0x7ff]}) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:41 executing program 0: r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 515.265959][T18764] loop4: detected capacity change from 0 to 4 [ 515.274170][T18788] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 515.277694][T18764] EXT4-fs (loop4): bad geometry: block count 3238199298 exceeds size of device (2 blocks) [ 515.329464][T18788] loop5: detected capacity change from 0 to 4 [ 515.336209][T18788] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:41 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001006c0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:41 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:41 executing program 0: r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 515.372554][T18824] loop0: detected capacity change from 0 to 1028 [ 515.407910][T18825] loop4: detected capacity change from 0 to 4 00:01:41 executing program 0: r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:41 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) exit_group(0x0) [ 515.427628][T18825] EXT4-fs (loop4): bad geometry: block count 3489726466 exceeds size of device (2 blocks) [ 515.455664][T18824] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 515.468224][T18828] loop0: unable to read partition table 00:01:41 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) exit_group(0x0) [ 515.474188][T18828] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 515.499035][T18842] loop5: detected capacity change from 0 to 4 [ 515.505510][T18825] loop4: detected capacity change from 0 to 4 [ 515.515065][ T1033] loop0: unable to read partition table [ 515.517293][T18825] EXT4-fs (loop4): bad geometry: block count 3489726466 exceeds size of device (2 blocks) 00:01:41 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f296d588ee40d58160fa73", 0xda}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) exit_group(0x0) 00:01:41 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:41 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000002", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:41 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200fffe19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:41 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) ioctl$LOOP_SET_FD(r3, 0x4c00, r0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r2, 0x81f8943c, &(0x7f0000000380)) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x4, 0x2, 0x80000a, 0x5, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 515.557670][T18842] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:41 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xe5', 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000040)=0x10000) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000300)=0x0) perf_event_open(&(0x7f0000000280)={0x3, 0x80, 0x1, 0x0, 0x34, 0xfa, 0x0, 0x8, 0x4, 0x2, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x401, 0x1, @perf_config_ext={0x0, 0x6}, 0x84e, 0x8000, 0x7, 0x6, 0x1f, 0x6, 0x1, 0x0, 0x4, 0x0, 0x600}, r4, 0x9, r0, 0x9) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:41 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600100740ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 515.634482][T18842] loop5: detected capacity change from 0 to 4 [ 515.641497][T18842] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:41 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xe5', 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000040)=0x10000) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000300)=0x0) perf_event_open(&(0x7f0000000280)={0x3, 0x80, 0x1, 0x0, 0x34, 0xfa, 0x0, 0x8, 0x4, 0x2, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x401, 0x1, @perf_config_ext={0x0, 0x6}, 0x84e, 0x8000, 0x7, 0x6, 0x1f, 0x6, 0x1, 0x0, 0x4, 0x0, 0x600}, r4, 0x9, r0, 0x9) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 515.691419][T18876] loop0: detected capacity change from 0 to 1028 [ 515.723325][T18880] loop4: detected capacity change from 0 to 4 00:01:41 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 515.735625][T18879] loop_set_status: loop0 () has still dirty pages (nrpages=1) [ 515.750313][T18880] EXT4-fs (loop4): bad geometry: block count 4278124546 exceeds size of device (2 blocks) [ 515.763443][T18890] loop5: detected capacity change from 0 to 4 [ 515.770928][T18876] loop_set_status: loop0 () has still dirty pages (nrpages=1) 00:01:41 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xe5', 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000040)=0x10000) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000300)=0x0) perf_event_open(&(0x7f0000000280)={0x3, 0x80, 0x1, 0x0, 0x34, 0xfa, 0x0, 0x8, 0x4, 0x2, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x401, 0x1, @perf_config_ext={0x0, 0x6}, 0x84e, 0x8000, 0x7, 0x6, 0x1f, 0x6, 0x1, 0x0, 0x4, 0x0, 0x600}, r4, 0x9, r0, 0x9) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:41 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 515.849254][T18890] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:41 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$CHAR_RAW_RAGET(0xffffffffffffffff, 0x1263, &(0x7f0000000040)) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 515.895672][T18880] loop4: detected capacity change from 0 to 4 [ 515.905652][T18880] EXT4-fs (loop4): bad geometry: block count 4278124546 exceeds size of device (2 blocks) 00:01:41 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000002000fff19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:41 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x8, 0x5, 0x20, 0x10, "4b9683a0377cfc5f81bfa6269b3fd96ce66cbedf1b08b30b8a591df219aa25f9212761d8343f582cac4fb138fcaf123d01ca33e83cc7c86071d738018f86d304", "90e526d07ac1e7b9f93f5f55b05b805fbc099baf409bf2f049c41a86a0eb3129", [0x7a792622, 0xfffffffffffffffd]}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_DIRECT_IO(r3, 0x4c08, 0xfffffffffffffffd) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 515.943083][T18908] loop0: detected capacity change from 0 to 1028 [ 515.967852][T18890] loop5: detected capacity change from 0 to 4 [ 515.977306][T18890] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:41 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:41 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd171c1c2d523be91b5877341e0e1dcc2025aa18c9228103b66e1000031d322dbecfa63da445b8bef5bd9125939f50bd2d4edccbf938604a348a666bf58b23ac4edcce412245deacb1f630e4052d0d6c20a45c772242f63a6bf41a08f4951d60a70381691f2", 0xd0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:41 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001007a0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 516.005582][T18908] loop_set_status: loop0 () has still dirty pages (nrpages=10) 00:01:41 executing program 3: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600121119000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 516.072666][T18931] loop4: detected capacity change from 0 to 4 [ 516.125669][T18931] EXT4-fs (loop4): bad geometry: block count 4279173122 exceeds size of device (2 blocks) 00:01:41 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) fsetxattr$security_ima(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000140)=@v1={0x2, "99"}, 0x2, 0x1) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 00:01:41 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 516.168746][T18953] loop5: detected capacity change from 0 to 4 [ 516.172854][T18954] loop3: detected capacity change from 0 to 4 [ 516.188953][T18953] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 516.194012][T18954] EXT4-fs (loop3): bad geometry: block count 286392374 exceeds size of device (2 blocks) [ 516.200754][T18931] loop4: detected capacity change from 0 to 4 00:01:41 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200feff19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:41 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 516.217846][T18931] EXT4-fs (loop4): bad geometry: block count 4279173122 exceeds size of device (2 blocks) 00:01:42 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:42 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 516.276375][T18934] loop0: detected capacity change from 0 to 1028 [ 516.288245][T18953] loop5: detected capacity change from 0 to 4 00:01:42 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 516.318949][T18953] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 516.355523][T18973] loop_set_status: loop0 () has still dirty pages (nrpages=2) 00:01:42 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600103c10ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:42 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x2, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x82203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x4, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0xfffffffd) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x40806685, &(0x7f0000000280)={0x1, 0x3, 0x1000, 0x1000, &(0x7f00000008c0)="baaea064713177792d9475457c195f689fc732022b4707b70a6c67b6a61db502a9ea4fcf9b7865abc262caa66b1723c5d9465a04a634f0fc792c1e44f9387161493fc319d34b2d23f2ce26f916897c8ba8405249f676b12df623f6ef94870b0f6d15fd7fa7e43a1997d4ec1ee4006b50cb3a42ab8c60af75da80a6f170e3b79f8b3a3f1fdcffa05abd4d909d3e3756943562db95bb93d7d952f5f9d6797cc0d67b541da1b3136d7784a913d951bf95701951209ef7ebdb0ade9e43a3f34fd2702d82438ee1a4cfb0a7aea20f697d4182f8d0d4ca8308c5e5e7129875307ce0f4968cc7e334bc0cad4b607b9e18ec7a029bc7211dc4f5505f284e20190f36e7ca7a90c1780ebe56a1e238908f0f5af63228c185bede31f489a1b3400dd9e83d1259f2fd4954320294c7b9ddb34d0155225618896fc53709efbcb48679ab89a79f0f6e5755fbfeff02e344247159112a78fd3524a137839cd6b81c423141e017dadaef9d3b454c1a554a46bcd747aa5072d27325164590fab1cfae76dea6234f58cab242af87a78ebc70da4a9caa2d254a45c5f673a5fd0ca7788251e3d39392a9a31d00b715f0fc74b521ffaf92f200212112d8bed93010cdf943503a75919901568610ffb9009ee79537bc35bd9d74cc9254e41cc320fcfc5cf65fda0b19907f84c303bc064bd02657be4a9a05b74fe43738ae57c85a8c866e321975de78412a5e1c26de275fa490fa1a3f6add29bd88b6acba95229b330a3950ec8abd1b2726b21bcb7a82918f58e8d6cc396a05c8c7ad58f2dff0d472f096109936673d50b1b130a47285b0f90d0273528a529bebb6e61e51dc2bf95e9c4ef9bd483e68c8e5269e9a95d2aefcca6a2e62be4ba049b7a20cf1c8834c0325c2b2fc62f4fdacfa5c2242c18eaa3bbc149955e1f5cae8299e25b6e9e377a408e98e1f44d51c8e6f8a09decabed320ff769f7c686d4f1f3be9f666f62ec71ef397ac1093379d026e371f917fa31449a8a1e562353ae1e1653c99319c60697579683b282d19743d0006d173c01b647aba49ed939e1261adc6e15f59be50de24231c5195c416c58ecb3855da616b35d21130820c6b3574e85b7b7eba1ec9036a822f3dbe33b9af9aea0afa3b9b39f24bdab8db5f5508ff9e20f786e54e824876766a804cfdb54afa5e53753b269bfc81be5112aeb123e240ec78d24e6867d50f215b238d62c03a666547a896609b819b40d4df89cca2349bf1a6ac5c78c6c7379e7eab3c3ca788b2a2aaa05546fa86e1cade9f664a644a1f0312e59208f8989af8719a13006b9d69f798f67ab1e7e27a884c0e007955ff948ca4aeab164d5ba9d91cb9d0bd488429f92a8731ab42481c68395483573d8810d4e15d36d70f9dc5195618c308588a3aac177e49b844ef26e554b2d7d35a3ebf83c6fd4519be280cf33c9bd06631a50b50e3e2176faf4c52da441b0027b617e7b0dd1014b3917b02cb5480bc82fdce753fe28b7e741e68eaffb9eb727bd12e7c2c3fee17ffbb36eea8d118b66b6e987f22e3fb43ec9a536fce35b51a51b4042e329602cc03802883f0f16b878d29650c9e099fb075c80b660a3b9b8d6a8b7ec21d12013db8fbce8cd491c06a47e7ca5b4e0c7126df0a562020754be5a6426f4f60fb9c7f461a6c7678da78d6ce87b5fbd034b65717b9f1a59c6bc424669b56535015e9d3a6aa467fc98209563ee21de4bb2a3f437ec54a2514087f771c5d913ccc051c4fb4f8456ede1b35b77855ea826cf7241ec5814b5adab3abfab8d240b4d9d1cd682d30e9f70f7473f6acf0e9ad498da5c703ecdf288292b9033eb650e1f54749d94536cd3fea8654ae38c4b8851fd06e90b7c8db24a4b0b7b5f763de33b2d91328dfde93e2523be2188bf00e2f83fdb2af336336f0389565b6c8cd1c5e61823dba93cabe768b1fca79311743cf6788706338395339b373fed7bc0112c0881cc4bd7a78328d9547f9ce471a2569cd184d9c77ab47a945b0f116724785ea52d4f1c0a82781cc8aa0c1489af13ccda3d536c21a429c2bc88b8929f9b0c7a173a3821fbfedc91201bff826e5a001bc9af9ab4a6e28458654a80bd6f9727d0e8b6887b70a45fde8a4c044bc1fa41034e66c5b62493ada104d7e82801bc274ed9452892c175e1b43cc74c6ac66553b374ccf4c7e4f0fab72441d74ec4cac847552f838bb155f96b8453b63764bc3e04a0c7c78f51b8e5336783e0aacecc0d58d667c06459f558df47abd73bf0e829d8b4a3022cc6dce0479360513b573caaf92f58043cc6d5c70292dd366cce76ed86c414399ad69e01c98baa71ff12f48fef3ad789c24f5b43c1e8e343080d48b7752a3149b38dbe363314780b9759f769651a8bc2f4d58ae99ef7b5d665c850bc6a8ce4d18dd5afc964f0140bb12fd9f206f63a5a23a4343c58d1c331216535ebd65aa1354f8e7cb53d34e9d4d63b264631fce9b3664453cb41a18151353bdc3cdcb1bfd8e66c260661d5eefa5ebfe8ef4712f83eba17cb6b153eac5545007d0be44214baaa1e60804b8af90992d47bca98c4d36a2f229958f74f44e74b3ce6991409f923cb7805f85abc1c5b37fd4ddffac4f28cb2ded61fd3252aef68301d64241858a9bccc7ebb068a826b82c924e36765c18994ffd56c614eea9fcc0a55c78f9209a4846b94c85f3bce6d7a482384fceb48b1cdfe33720061f0f5657b6e8cd1dc31c0954ecd0d8e1ce45ea27e4b3bf292bb73c7a166fc5b66c29994566aea5194f5b6b62b18f9ed185e0132f29a16a272a0b08aca71972226ecbb9ec29406f87f7d409da73967c79001a0acf18661f45826fd1ce701959e91a486c947dd8cd30371c38ae108de6f9ca092b859a42ad20a00cbe378e432df0be1f3840dc3b5b9847664605e418e279de74ef4d01ce7232e8a36b698eaf1b0678a8b77fce49784485f980101a6f1ce31dff246d254b781ca9264946fc7e48296c0681d324e512e618ab8b1567c8714ab0d42e114676c4d7930eb7b22be32f7cdc6fd21e82ce868346a997e85fa8c80b316296486c2ad2cbf258565da64f05ca2f1f5d236763825c4a2c80386e366e994529bc42178b76349aca61a8aa7ac5539e4205f8a9813e0a5a4e83aa491be9fbbc80df0c0f16419b9a9328d9be21b8cca5ebadfb9d020eab6ac4b8718dc4b12cc98ebde93528331c0094f9fe8fb0b50bae309bde5a90b8c2591da7acb2d44ba069d4be0b0a142a76ed6669915ca97d61563166b19160ea7b6db8ea193325922f31793235dffcaabf3de9a08949aaa6feacf18b42abbe341d453c9c5234e2826aa3c50b69e3316847dfbc5ec64dcf8935f83053e130f317931a378d0ca7639ba71911f17f6118564269044c07cc181b5c0f042536e204bae5233eaf9dbb2f9cde0c769c1adb2c5ad3bae99bc07eee1cbd59a61565b1fe6b715d2e0fd7bd2bfbc78fe39e3101660fd28516596e996b68c0473cadbd195acdfbbf359729945ae26d79576f9747e0f89b22f39e8101102fd7a5b8408569870f6136e2d9e126441475b27c8f3034edd0c23787a39ca9adcbd13c20e573d20246f73809e8e6cf6791845198587f911abae4799698be1c778ab8ca031924bab02d7ad159c91a20fb7b02426a608f53fb87158775659232a54800fbeb665c754e84a19447c41420c623a619b6c0a3a8cb03b68c160b0c6c8dcb9db2105a8942b162a064186a6e5434c8543e24b6ed24dd13b7a0d86f1c4fd5545ac65151cebabdb09da8af0a3120ae92f9d1fe5226055436a3898ea73e4dd7351487c4f56a645470e0cd3bfab62f9bd23abd7e133bb02a1a1498a7740c55065567cd11b6c216134d287d102bc1360bb51995764ef334dd31610977e8c20dc3d6bfdc4c75f166cd633f44b9dcfd29ca1c613a3b00acaf3b5201ba8c4080312c0e43940fa0f793b64a1befb7bf11d3174611fbf862fdff4837e0c29ab2936094ba30c656910201d0241532fd41e2da05734638a910283afb4bc80df932883bd9c720edf066fe9261a7f2d940e7f256e4d2118eb8d49b84a96a85368d4653c4d6d1d2d7b4951b34618d5dd434c3bde0b72e3571701b649d6c274f06cda9c717d1961f86a4d5484d0f5981708af1a341e10485d4f98731ca657cee87483953dbc6ad3eea5c41fee439727be025e0dc20d041d9da932ed99ccd9b4f9c2b014885b9d0ca6b1060432fc8bd354c26b31c6ff1ad6e79be9017db6d55b62cca18f8da5168c51ebaad30f7eec3549fb915a3f1a9a2e3357967501dc0a11d28e07a5bec4687760750a1b2aa1badaf30ca64fdab2cf39e263341a15ea388cf314926597d3bd88e4da8b67c57cc43f61659c447ed4302348736eed8e2f96b4609d17e42f309dc19fe782e79b04a5d81aae7db59cc504e799d7d209aec6324de797ddc909f22b50f32742ca79ecba1a38e1f7415bb555a226a2f332735ee4506f46df3df356b70f8388a95d614cbe7f9a8d0e8c9c293d3d98ae6342843d525e0f7d51d244989e1ff703a55fd7f4f0711364c5d5919ff6dc6f5ab00eac9e8f0fe92eb324d6aec6df4e9341c708bfe6dff68079a567c4e0e0fee22fd8421427f5e0dbc4202f1c34b74c0cb8c4bd48c0afd6536fb38a66c4b39c470e0b2852d924de247f8627b27be29a72be3cba48ea06e582396aaf6be8044f41a8b51dcc5304656a5d7b9030094c0afdcf657b5abcb05df5c0b5c6532556d059b9bea5a882d4d6dfe1bd10ac402df80fd2854a54639b000e5cea70d0f6b1655ff25deb5034c170dea670c85db93e2893e75b351367e1496388fafa8e533b10894722befd5ab633d41b2d4aa76862179fb3134f75a0478033550cde4a9b1a9a248b3cfd25f93f4f3db5824a28ab4c1c9f1e5c68aeac7fe20dec774081b9b70b745d6daa6e9d43d9f7c9f2130ead1447a8ac7344b5646c53255a913059921de650598b9ddb34e74cd11ceb227136e94b3c46a4a947ac3efe8ff5f84e3f5491f6d47fc57b0517a91469f8ad6ff54ab3596056ec5ecf7a97272c3231932bd0198bcd6057f9840de3d9a5a6b1c63c789eb54545eba1a9afa7c6c0ac147abb06f0e7f40f4d1c40a62f8cff755e5aecdf87327b2cc92d91dddcc0783a20d7bada73858e84e4615466361907a41bbee94857266f6b2d0f962b27ce272e813397979ba16cadfd356d905af5dbc910ceb80738059be11caf733ccc2bc01889f17adaa0e5768d3132e62a00d49827843d7c1c2b021d1c2641a2fe03ddcce342575f004513fe98bd129afc9407bfc6f6696be2bcde4e3ec74a6478d635c13915b778a0d3c73adb2fc23915d3b332535df7e75925969fadcad85c4adf744b6db9145faecf87be8edad20b95abbc50623a80dc5f4b95ac3447ba7b862b1dea3f8a3d66c1aa0e196f038adddf63b5ea5108e059fb1ebccd846907e0640464434b0e76a72d6770d52d97ffd99f80838af0cb20bf7242fd90c8cc85dcf08c72fcb30fc52f907bce3086551c06c6abf13ffe51d3539d64f643cb3f3d4b6b5bc84262437796ed97a8df2488e9629a80921b92ceb13cd3a29970c22947f22dfe40c6919f63f40ee781cf4a96b5325803ac0d8d393631a8c2b0b7fbd79596713a0f31829855342d817b047af77676747ee2843dbba0008d38d90b49cdc07a7c360790aac184cc96f3362570fdc4a52aacaa40ee83cd1fdab8737a4e2a957270a607083f31988301f34a21dcaae0c18b9a0d39ddb7d1bf9bcb5e960af7798e7b87b9a8c7a2cc4a936acff309eeb657bf5012d7ec5288ea7b1942ba8cb3c8ef4a32890", 0x16, 0x0, &(0x7f0000000040)="27267e16f165922443cd7a0e5813e6d8fad907893c78"}) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x14) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000300)={@loopback}, 0x14) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:42 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:42 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000007000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 516.379026][T18988] loop4: detected capacity change from 0 to 4 [ 516.394589][T18988] EXT4-fs (loop4): bad geometry: block count 4294836226 exceeds size of device (2 blocks) 00:01:42 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x2, 0x80, 0x0, 0xff, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2, 0x1d50000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) syncfs(r0) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 516.481134][T18996] loop0: unable to read partition table [ 516.486912][T18996] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 516.536366][T19016] loop5: detected capacity change from 0 to 4 [ 516.543065][T19018] loop4: detected capacity change from 0 to 4 [ 516.591893][T19016] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 516.613247][T19018] EXT4-fs (loop4): can't read group descriptor 0 [ 516.649128][T19016] loop5: detected capacity change from 0 to 4 [ 516.649679][T19018] loop4: detected capacity change from 0 to 4 [ 516.663703][T19016] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 516.666607][T19018] EXT4-fs (loop4): can't read group descriptor 0 [ 516.762230][ T1033] ================================================================== [ 516.770759][ T1033] BUG: KCSAN: data-race in vfs_readlink / vfs_unlink [ 516.777423][ T1033] [ 516.779761][ T1033] write to 0xffff88813407ea80 of 4 bytes by task 15752 on cpu 1: [ 516.787457][ T1033] vfs_unlink+0x289/0x400 [ 516.791977][ T1033] do_unlinkat+0x238/0x4f0 [ 516.796469][ T1033] __x64_sys_unlink+0x2c/0x30 [ 516.801452][ T1033] do_syscall_64+0x4a/0x90 [ 516.805975][ T1033] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 516.811869][ T1033] [ 516.814176][ T1033] read to 0xffff88813407ea80 of 4 bytes by task 1033 on cpu 0: [ 516.821871][ T1033] vfs_readlink+0x1c5/0x280 [ 516.826364][ T1033] do_readlinkat+0x170/0x200 [ 516.831053][ T1033] __x64_sys_readlink+0x43/0x50 [ 516.836149][ T1033] do_syscall_64+0x4a/0x90 [ 516.840552][ T1033] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 516.846620][ T1033] [ 516.849021][ T1033] Reported by Kernel Concurrency Sanitizer on: [ 516.855324][ T1033] CPU: 0 PID: 1033 Comm: systemd-udevd Not tainted 5.13.0-rc2-syzkaller #0 [ 516.864158][ T1033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 516.874296][ T1033] ================================================================== 00:01:44 executing program 3: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200600000200000019000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:44 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:44 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) r4 = dup2(r2, r0) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000380)={0x0, {}, 0x0, {}, 0xffffff81, 0x5, 0x17, 0x18, "fe9932b333ba451234cdac6fd251057b9670243022f4373590129bf71543793bec2acde14cd428697b4f3d6222b5e3590a728596061cb0cf1348f23bcd1953aa", "0e7376b2bbbe957c6df321a2c22095ead8e4ef5128c8e7bf1010c84bf1a33955", [0x2, 0x7fff]}) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x0, 0xc, 0x19, 0x4, "c81d27494425f8d25c7af1e48476eb0cee8d09c050285a6626b1f85f2b73851cc54fc24f07f8a56284fbb1f6c5f5d0e38ee6b60f4b93cdb4fab41965c5d072a0", "f12f5f0ab7123996fbdde03cfef85f14c1c79eb4b3849db49e95a914d913d7ef", [0x81, 0x8]}) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:44 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000004", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:44 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000219000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:44 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600102c20ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:44 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 519.014073][T19055] loop4: detected capacity change from 0 to 4 [ 519.016430][T19056] loop5: detected capacity change from 0 to 4 [ 519.020519][T19057] loop0: detected capacity change from 0 to 1028 [ 519.037471][T19062] loop3: detected capacity change from 0 to 4 [ 519.044589][T19055] EXT4-fs (loop4): bad geometry: block count 33554434 exceeds size of device (2 blocks) 00:01:44 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:44 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000319000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 519.127175][T19056] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 519.130863][ C1] print_req_error: 231 callbacks suppressed [ 519.130878][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 519.159693][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 519.171074][ C1] buffer_io_error: 226 callbacks suppressed [ 519.171086][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 519.215441][T19075] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 519.232573][T19062] EXT4-fs (loop3): inodes count not valid: 1568 vs 32 [ 519.232741][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 519.248375][T19056] loop5: detected capacity change from 0 to 4 [ 519.250765][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 519.265307][ C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 00:01:45 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600102c30ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 519.274424][T19056] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 519.276905][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 519.277117][T19058] loop0: unable to read partition table [ 519.291200][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 519.295747][T19058] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) 00:01:45 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 519.301400][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 519.329891][T19086] loop4: detected capacity change from 0 to 4 [ 519.333784][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 519.350635][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 519.357282][T19086] EXT4-fs (loop4): bad geometry: block count 50331650 exceeds size of device (2 blocks) 00:01:45 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = gettid() tkill(r1, 0x40) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x17) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) timer_create(0x0, &(0x7f0000000040)={0x0, 0xc, 0x0, @tid=r2}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) [ 519.370087][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 519.381483][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 519.418197][T19086] loop4: detected capacity change from 0 to 4 00:01:45 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) perf_event_open(&(0x7f0000000280)={0x4, 0x80, 0xff, 0x6, 0x80, 0x0, 0x0, 0xfffffffffffffffa, 0x1400, 0x6, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1000, 0x4, @perf_bp={&(0x7f0000000040), 0x2}, 0x18023, 0xffffffffffff7fff, 0xcd7, 0x0, 0x5, 0x6, 0xab, 0x0, 0x7, 0x0, 0x6}, 0x0, 0x7, 0xffffffffffffffff, 0xb) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 519.425917][T19075] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) [ 519.430387][T19101] loop5: detected capacity change from 0 to 4 [ 519.445924][T19086] EXT4-fs (loop4): bad geometry: block count 50331650 exceeds size of device (2 blocks) [ 519.458486][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 519.469402][ C0] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:45 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:45 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0x13b9, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 519.479807][T19101] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:45 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:45 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000419000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 519.565547][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 519.576498][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 519.587711][T19101] loop5: detected capacity change from 0 to 4 [ 519.603279][T19101] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:45 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:45 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0x13b9, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 519.612813][ C0] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 519.623713][ C0] Buffer I/O error on dev loop0, logical block 0, async page read 00:01:45 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0x13b9, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:45 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000003600000019000000600102c40ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 519.675353][T19115] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=1) 00:01:45 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0xc11, 0xa, 0xa, 0x10, "0e8277466f1158db5db1e14da03a1382cc8d867822d836d7073219376d3764d0ad33056a225b6d47df5f31d551500e9aa213548ad152347a818c993126e1e51a", "922f004d6abdcdc5f3f4550908763f4d3d1128f5e48b398f7a0bb5d81251c789", [0x3]}) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:45 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:45 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0x7cd, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 519.740916][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 519.758188][T19132] loop4: detected capacity change from 0 to 4 [ 519.769905][T19132] EXT4-fs (loop4): bad geometry: block count 67108866 exceeds size of device (2 blocks) 00:01:45 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000519000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 519.789813][T19150] loop5: detected capacity change from 0 to 4 [ 519.796305][T19148] loop_set_status: loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) has still dirty pages (nrpages=2) [ 519.810517][T19150] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 519.828914][T19132] loop4: detected capacity change from 0 to 4 00:01:45 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 519.835783][T19132] EXT4-fs (loop4): bad geometry: block count 67108866 exceeds size of device (2 blocks) 00:01:45 executing program 2: mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:45 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0x7cd, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:45 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:45 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 519.867314][T19150] loop5: detected capacity change from 0 to 4 [ 519.874116][ T1033] loop0: unable to read partition table [ 519.903460][T19150] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:45 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0x7cd, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:45 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:45 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001fffe0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 519.917971][T19171] loop4: detected capacity change from 0 to 4 [ 519.947651][T19177] loop0: detected capacity change from 0 to 1028 00:01:45 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r2) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r3, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x3, 0x0, 0x0, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae01000000000000000fa338dae25c520c00", [0x2, 0xfffffffffffffffe]}) 00:01:45 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1f", 0x36}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 519.996096][T19171] EXT4-fs (loop4): bad geometry: block count 83886082 exceeds size of device (2 blocks) [ 519.999495][ T1033] loop0: unable to read partition table [ 520.012146][T19182] loop0: unable to read partition table [ 520.018380][T19182] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) 00:01:45 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x77, 0x3, 0x1e, 0x8, "7d9e9ead2b43009c31de8e9d4e3cd39315904ea6f143216df83b4b81dbdb647a7376240535bd8e93a576e59bae35d03f372b04791b855a272d5c01f459459e3e", "0eadfc6a9d1e6356aaa1c891d9b0493e62ff9d7e416db2ec1ba3ca4d85b86a3d", [0x1, 0x1]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000380)={0x0, {}, 0x0, {}, 0x5, 0xa, 0x1, 0x0, "a645fff416d2f551f2a9c43b53a06c3370f9ae043c23480c0ab1ff1cd0643d01de2c011f921223abf311662b9e046777c8ce12191148bcafccd1176e64c3f7f0", "bf6b8bc66c4d8d9e480620f27ed3d56d5a0886f7493245881e0134570e2c9e11", [0xe5, 0xffff]}) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:45 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000619000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:45 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0xfdfdffff, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:45 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1f", 0x36}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:45 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800cf511b", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 520.052843][T19171] loop4: detected capacity change from 0 to 4 [ 520.058845][T19203] loop5: detected capacity change from 0 to 4 [ 520.065910][T19171] EXT4-fs (loop4): bad geometry: block count 83886082 exceeds size of device (2 blocks) [ 520.067254][T19203] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:45 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1f", 0x36}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:45 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0xfdfdffff, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 520.146177][T19203] loop5: detected capacity change from 0 to 4 [ 520.163267][T19215] loop0: detected capacity change from 0 to 1028 [ 520.180860][T19203] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:45 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c09", 0x51}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:45 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0xfdfdffff, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:45 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="20000000360000001900000060010fff0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 520.198989][T19227] loop4: detected capacity change from 0 to 4 [ 520.207541][T19227] EXT4-fs (loop4): bad geometry: block count 100663298 exceeds size of device (2 blocks) 00:01:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c09", 0x51}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 520.258705][T19227] loop4: detected capacity change from 0 to 4 00:01:46 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0xff0f0000) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 00:01:46 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x20, 0x2f]}) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x800, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0xa, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 520.319779][T19239] loop0: unable to read partition table [ 520.326068][T19239] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 520.340721][T19252] loop5: detected capacity change from 0 to 4 [ 520.348711][T19227] EXT4-fs (loop4): bad geometry: block count 100663298 exceeds size of device (2 blocks) 00:01:46 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000719000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c09", 0x51}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 520.372385][T19252] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:46 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7", 0x5f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:46 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001feff0ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:46 executing program 3: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000619000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 520.513695][T19252] loop5: detected capacity change from 0 to 4 [ 520.529430][T19252] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 520.531801][T19287] loop4: detected capacity change from 0 to 4 [ 520.549951][T19287] EXT4-fs (loop4): bad geometry: block count 117440514 exceeds size of device (2 blocks) 00:01:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7", 0x5f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:46 executing program 2: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000280), 0x1000000000000391, 0xd9f, 0x0) preadv(0xffffffffffffffff, &(0x7f00000019c0)=[{&(0x7f00000004c0)=""/53, 0x35}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000380)=""/245, 0xf5}, {&(0x7f0000001a80)=""/220, 0xdc}, {&(0x7f0000000280)=""/181, 0xb5}, {&(0x7f0000000580)=""/172, 0xac}, {&(0x7f0000000640)=""/146, 0x92}, {&(0x7f0000000480)=""/2, 0x2}, {&(0x7f00000007c0)=""/90, 0x5a}, {&(0x7f0000001b80)=""/241, 0xf1}], 0xa, 0x7, 0x9) preadv(r2, &(0x7f0000000280), 0x0, 0xd9f, 0x4) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, 0x0) r3 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$LOOP_SET_STATUS(r3, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 520.590815][T19307] loop5: detected capacity change from 0 to 4 [ 520.624535][T19307] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:46 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000819000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:46 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 520.643439][T19287] loop4: detected capacity change from 0 to 4 [ 520.653027][T19287] EXT4-fs (loop4): bad geometry: block count 117440514 exceeds size of device (2 blocks) 00:01:46 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x800, 0x2, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "ffffff4b18ecdb8dbf7d1bcff16be0bec480ebc5c2189e00", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7", 0x5f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b", 0x66}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 520.690513][T19322] loop3: detected capacity change from 0 to 4 [ 520.713976][T19322] EXT4-fs (loop3): bad geometry: block count 100663298 exceeds size of device (2 blocks) 00:01:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b", 0x66}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:46 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001000003f68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 520.746494][T19307] loop5: detected capacity change from 0 to 4 [ 520.776986][T19307] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:46 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0xf0ffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 00:01:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b", 0x66}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:46 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) pwritev(r0, &(0x7f0000000640)=[{&(0x7f0000000280)="cf7c65627a99ccbee58c4bb042ffd45a73a2589a5c3f734bdb7fd927bde88a79098b5dee75cd7cae36813d38afede7c1da2f208e3baea8f7611c64b5772d860537d3799c118f3f6d71f3526d27", 0x4d}, {&(0x7f0000000040)="1801b300274381f465a3f7ce42c7f183254a6c7bad4f3baa045940ff973d34a8f1a16693382e82", 0x27}, {&(0x7f0000000380)="5d9a260487af56ef0ea6846a5c42b0722188fa7daa35d4caefda3c20206fb6815dbdced8a414367ca2dd2c413d4ec087202310052f3a4e0a98258cbe7592f25ecd7d80d8484a2585b74c8a4ce6991c35d2e1937f219db0db071d70a48016fe7d6a8dc0ae7b944a008039e7b6bb462711984fbf2713361725eee3bf8c0a0e7534cabc332cff9838b6b93ead2a1ce9166f8b7630bb8dfa926ea0479442cd7c69dd72c82b974cc7b4b0511b873de0c70d6e49f83fa9a697bc8337c1c3993521d9813a6c42717364699a44f394a2296244b745a15711e971120f8891e2b00bdfde2e073884c146ee20a3fcd5dbdd39dc5fcc070452cbe7cdea", 0xf7}, {&(0x7f0000000480)="4a711d9f5bf8c7d93cc09b40524c3823a4836afe31860900ec600c3b3709071d707661f5bbc8014023203d9c8f04c10671dd4fd9fbce161a59dd51b75b364c2635ebb24f6630262134f3dc5b223c07f7720513191b42949ca7ba077b904bddf20108fd224e67691bdc3f3161ccc0e9aa61236a811b8461e59100ec3b4967b289f7759668637a229937ad96a94ad498cae5611e4442cbd514f47ed01a4ffa4851f7e9e15cf30322ef9fcd55a5bb1593de8035a96d367e8df22b9e3b7d55bed975801ddd10e9d03186b0f9", 0xca}, {&(0x7f0000000580)="e7816a129f8e673ce69a4fdd1b7c9fd3e09313848a85c39864475d0b9e5fb9ed7771022baf6ff16b2ade4a38581cba91783e58154f29155b38f3c5ecdc44f05847cf2797c6205320993077c62381756f72db74d24d7bcb1b953b812e7265430eb1a518acafe4d2e90e362976ce47559e4204e849f3d2b57cf39d59e24b617601c8b2fa757096b6a9a72fbd5f69", 0x8d}, {&(0x7f0000000780)="89cf4025f4bcf91078ddbaa12f695e6b9ef2625c5d4aae9470ef63998674052cbb9a26ca82932103794130be361422b7eb45dfca34c357f0839e329f67e7e4b3e3f924885af411a30f4955ed3cc8f5a00647d39dde82fd92c5e4b66ec16a0681c2320383004ba8eba00b4ea0a732857dd5f7c02b3c6304228120f1aec43027647cca40f61dae039c07a3ce7cddb4b5568d1f403ea0739b3323db77199898f1278dbf0645f82cd8cedef20ae18520d06ae293c596f5163683a431336e92740073900993c1cce7f9d55b0573e93a87eb0fb4656f16fcafbf836137939218e37752974288c9b88fc301f146baebbdbd67f99a18dfc683d0318184f7ef24c9", 0xfd}], 0x6, 0x0, 0x20) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 520.886447][T19349] loop4: detected capacity change from 0 to 4 [ 520.902366][T19349] EXT4-fs (loop4): bad geometry: block count 134217730 exceeds size of device (2 blocks) 00:01:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b8", 0x69}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 520.940465][T19366] loop5: detected capacity change from 0 to 4 [ 520.974573][T19366] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 520.980529][T19349] loop4: detected capacity change from 0 to 4 00:01:46 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800000004", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 521.001620][T19349] EXT4-fs (loop4): bad geometry: block count 134217730 exceeds size of device (2 blocks) 00:01:46 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000919000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b8", 0x69}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:46 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000280)={0x0, {}, 0x0, {}, 0x1, 0x8, 0x13, 0x1, "7c842a8716a5d3257bc20a21bbda6c299c730f5437acf10ff5b759407ef848db9b00d164fbe1c0f59f2237c66b6d9427ee82672c4d869d4e8de27bed305fee35", "7f441b579e456d7bfcfd47b0a21561f0cf711c974c4cf803af9ede162a1ffd67", [0x1, 0x4840b9ab]}) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b8", 0x69}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:46 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001000005f68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 521.081191][T19366] loop5: detected capacity change from 0 to 4 [ 521.099637][T19396] loop0: detected capacity change from 0 to 1028 [ 521.101178][T19366] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:46 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89aff", 0x6b}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 521.182948][T19409] loop0: detected capacity change from 0 to 1028 00:01:47 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd2042044848000200fe07000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:47 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89aff", 0x6b}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 521.245812][ T1033] loop0: unable to read partition table [ 521.248286][T19416] loop4: detected capacity change from 0 to 4 [ 521.251686][T19422] loop5: detected capacity change from 0 to 4 [ 521.260001][T19416] EXT4-fs (loop4): bad geometry: block count 150994946 exceeds size of device (2 blocks) [ 521.277379][T19422] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:47 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001000006f68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:47 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000a19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:47 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89aff", 0x6b}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 521.327279][T19422] loop5: detected capacity change from 0 to 4 [ 521.334089][T19416] loop4: detected capacity change from 0 to 4 [ 521.334686][T19422] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 521.340590][T19416] EXT4-fs (loop4): bad geometry: block count 150994946 exceeds size of device (2 blocks) [ 521.355099][T19409] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=1) 00:01:47 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:47 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x4800, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:47 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000600)={0x0, {}, 0x0, {}, 0x8000, 0xa, 0x1c, 0x10, "aa7ec13e5b0d82ba9ba73c80f179530d8a6911bd903d14acbf27e1cb2cc1460dd60b00d6cfd8818d7275e56f86ef390bfe87ec60332ed1b7d4043cc148c093f1", "e695848732f14d20795322f833e055a626499541545f7a476aa54ef360913716", [0x0, 0x7e9]}) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x10) preadv2(r5, &(0x7f0000000540)=[{&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000380)=""/244, 0xf4}, {&(0x7f0000000280)=""/50, 0x32}, {&(0x7f00000018c0)=""/4096, 0x1000}, {&(0x7f0000000480)=""/170, 0xaa}, {&(0x7f00000002c0)=""/101, 0x65}, {&(0x7f00000028c0)=""/4096, 0x1000}], 0x7, 0x6, 0x9, 0x4) 00:01:47 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 521.417535][T19455] loop5: detected capacity change from 0 to 4 [ 521.423889][T19456] loop4: detected capacity change from 0 to 4 [ 521.425612][T19455] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:47 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x4800, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 521.474881][T19456] EXT4-fs (loop4): bad geometry: block count 167772162 exceeds size of device (2 blocks) 00:01:47 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:47 executing program 3: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x4800, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 521.520022][T19456] loop4: detected capacity change from 0 to 4 [ 521.545080][T19456] EXT4-fs (loop4): bad geometry: block count 167772162 exceeds size of device (2 blocks) [ 521.551590][T19474] loop0: detected capacity change from 0 to 1028 [ 521.561711][T19455] loop5: detected capacity change from 0 to 4 00:01:47 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:47 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000b19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 521.580277][T19455] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:47 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001000007f68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:47 executing program 3: mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f00000001c0)=0x0) socket$inet_udplite(0x2, 0x2, 0x88) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000200)=0x40000001, 0x86, 0x0, 0x0, 0x0, 0x12000000) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 00:01:47 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = accept$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000280)=0x14) mmap(&(0x7f00007ba000/0x2000)=nil, 0x2000, 0xc, 0x13, r1, 0x545b6000) r2 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r3 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r3, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r2, 0x4c00, r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r2, 0x4c02, 0x0) r5 = dup3(r2, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 521.688419][T19504] loop4: detected capacity change from 0 to 4 [ 521.697335][T19473] loop0: unable to read partition table [ 521.703088][T19473] loop_reread_partitions: partition scan of loop0 (@ܸ%2xZ?h2~*2%:QGJR BHH) failed (rc=-5) [ 521.721621][T19504] EXT4-fs (loop4): bad geometry: block count 184549378 exceeds size of device (2 blocks) 00:01:47 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) 00:01:47 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:47 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) r4 = fcntl$dupfd(r3, 0x406, r0) ioctl$LOOP_SET_DIRECT_IO(r4, 0x4c08, 0x8000) r5 = dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370d7da4f5fbe2437380adf094ab2d8e39b498e8d7782a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) [ 521.851022][T19524] loop5: detected capacity change from 0 to 4 [ 521.887253][T19524] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:47 executing program 3: syz_open_procfs(0x0, &(0x7f0000000040)='net/fib_trie\x00') r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) r1 = openat$random(0xffffffffffffff9c, &(0x7f0000000000), 0x40200, 0x0) dup2(r1, r0) 00:01:47 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 521.902099][T19504] loop4: detected capacity change from 0 to 4 [ 521.928938][T19504] EXT4-fs (loop4): bad geometry: block count 184549378 exceeds size of device (2 blocks) 00:01:47 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002680007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 521.956843][T19533] loop0: detected capacity change from 0 to 1028 00:01:47 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:47 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x182) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x19, 0x0, "5b6e292720ad1c122716751da9bf189513d61d4796c07a6a60c48e0a829f91b97739809d64e869ae16798a44aad614fac6a21d3dcf2b3e871587f53cd809f98e", "f8b699c929b92ee722240b5b4c44a41eb88c87cff1866be0bec480ebc5c2189e", [0x0, 0x2d]}) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r2 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d", 0x4}], 0x1, 0x80805, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) dup3(r1, r0, 0x80000) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000180)={0x0, {}, 0x0, {}, 0x6, 0x0, 0xa, 0x4, "afd72c77ac9ca8206467ca463819c0f29effe69e6a80cb67ba8899b6097bc9fe4c6108370c7da4f5fbe2437380adf094ab2d8e39b459f9cfe62a917c33fdc5fe", "d236af968133ae234c75a40f708461b991d9b5a4fed72ca50fa338dae25c520c", [0x2, 0xfffffffffffffffe]}) 00:01:47 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="200000000200000c19000000600100000ff68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) [ 522.042806][T19524] loop5: detected capacity change from 0 to 4 00:01:47 executing program 5: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="2000000036000000190000006001000009f68f01000000000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}, {&(0x7f0000010100)="0000000000000000000000026856d49a00cc4371bd6a7c893f280045010040", 0x1f, 0x4e0}], 0x0, &(0x7f0000000380)) 00:01:47 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:47 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000880), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="d444f36d86d143", 0x7}], 0x1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000008c0)={0x0, 0x36a4cdfafc70f4f9, {0x0, @struct={0x9, 0x2}, 0x0, 0x3ff, 0x181d43d20000, 0x40, 0xfffffffffffffffe, 0x1, 0xd, @struct={0x40, 0x7}, 0xb6, 0x0, [0x0, 0x0, 0x5, 0x0, 0x8, 0x800]}, {0xb16, @struct={0x0, 0x7}, 0x0, 0xea, 0x0, 0x0, 0x800, 0x5, 0x60, @usage=0xbc3a, 0xfff, 0x1975, [0x0, 0x1000, 0x0, 0x401]}, {0x3, @struct={0x80000000, 0x8000}, 0x0, 0x300000000, 0x812b, 0x7, 0x80000001, 0x6, 0x40, @struct={0x3, 0x6f4}, 0x3ff, 0xb0, [0x401, 0x0, 0x0, 0x4a, 0x800, 0xfffffffffffffac3]}, {0x622, 0x0, 0x1}}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, {0x4c}, 0x1f00, {}, 0xfffffffe, 0x0, 0x1d, 0x19, "408b0301dcb8a402cc02a52532785aec11a63f6832927e2a8932b625a63aa002e00751470e814ab516c15286fd20420448480002000007000000004800", "b89b67ed7f1d20d113f405d53b1b4549a3fcb55be159afa1c02188b895618eab", [0x712dce36]}) dup3(r0, 0xffffffffffffffff, 0x80000) [ 522.098801][T19524] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) [ 522.135119][T19539] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=2) 00:01:47 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/fib_trie\x00') r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0xf8) dup2(r0, r1) 00:01:47 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:47 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) [ 522.195043][T19559] loop_set_status: loop0 (,w dgF8jg {La7}Cs-9x*|3) has still dirty pages (nrpages=1) 00:01:48 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000640)="66530700ae897094e7b126825deaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26e45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e054859cff15f715134d82ce9c096bd644157684e3dae491de7642a7c52ca392aeb56b80d6b89affd1", 0x6c}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x5) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="4dc3", 0x2}], 0x1}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) exit_group(0x0) 00:01:48 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x800c0, 0x82) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x40, 0x0, 0x4, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x44}, @NL80211_ATTR_MESH_CONFIG={0x24, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_TTL={0x5, 0x6, 0x9}, @NL80211_MESHCONF_AUTO_OPEN_PLINKS={0x5, 0x7, 0x2}, @NL80211_MESHCONF_POWER_MODE={0x8, 0x1a, 0x1}, @NL80211_MESHCONF_RSSI_THRESHOLD={0x8, 0x14, 0xffffffffffffff8d}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4b52aebc00f61956}, 0x4004804) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/fib_trie\x00') r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) dup2(r1, r2) [ 522.257555][T19573] loop4: detected capacity change from 0 to 4 [ 522.267105][T19573] EXT4-fs (loop4): bad geometry: block count 201326594 exceeds size of device (2 blocks) [ 522.269214][T19572] loop5: detected capacity change from 0 to 4 [ 522.285939][T19572] EXT4-fs (loop5): bad geometry: block count 54 exceeds size of device (2 blocks) 00:01:48 executing program 2: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x