TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 266.082228][T23911] loop2: detected capacity change from 0 to 19 [ 266.214779][T23925] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 266.225796][T23925] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:49 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 266.256153][T23925] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 266.264856][T23925] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:49 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\r\x00\x00', 0x0) [ 266.391807][T23911] loop2: p1 p2 p3 p4 [ 266.407117][T23911] loop2: p1 size 78398975 extends beyond EOD, truncated 11:01:49 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:49 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:49 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x0e\x00\x00', 0x0) [ 266.431947][T23911] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 266.447933][T23911] loop2: p3 start 2127165541 is beyond EOD, truncated [ 266.454951][T23911] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 266.562194][T23734] Buffer I/O error on dev loop2p2, logical block 8, async page read [ 266.563469][ T616] Buffer I/O error on dev loop2p4, logical block 8, async page read [ 266.570989][T23911] __loop_clr_fd: partition scan of loop2 failed (rc=-16) [ 266.584552][ T616] Buffer I/O error on dev loop2p1, logical block 0, async page read [ 266.594396][ T616] Buffer I/O error on dev loop2p4, logical block 9, async page read [ 266.620100][T23911] loop2: detected capacity change from 0 to 19 [ 266.668311][T23911] loop2: p1 p2 p3 p4 [ 266.672952][T23911] loop2: p1 size 78398975 extends beyond EOD, truncated [ 266.696086][T23911] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 266.714796][T23911] loop2: p3 start 2127165541 is beyond EOD, truncated [ 266.721754][T23911] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 266.730155][T23965] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 266.739040][T23965] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 266.769825][T23965] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 266.778454][T23965] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:49 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) 11:01:49 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:49 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x0f\x00\x00', 0x0) 11:01:49 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:49 executing program 2: syz_read_part_table(0x26d5, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:01:49 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:49 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x11\x00\x00', 0x0) 11:01:50 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:50 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) [ 266.983900][T23991] loop2: detected capacity change from 0 to 19 [ 266.997439][T23988] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 267.006265][T23988] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 267.051335][T23988] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 267.060245][T23988] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 267.090422][T23991] loop2: p1 p2 p3 p4 [ 267.106481][T23991] loop2: p1 size 78398975 extends beyond EOD, truncated [ 267.128299][T23991] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 267.159444][T23991] loop2: p3 start 2127165541 is beyond EOD, truncated [ 267.166394][T23991] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 267.213782][T24015] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 267.222278][T24015] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 267.261104][T24015] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 267.270156][T24015] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:50 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:50 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x12\x00\x00', 0x0) 11:01:50 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:50 executing program 2: syz_read_part_table(0x3e00, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:01:50 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) 11:01:50 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00H\x00\x00', 0x0) 11:01:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:50 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00L\x00\x00', 0x0) [ 267.458650][T24036] loop2: detected capacity change from 0 to 31 [ 267.494076][T24037] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:01:50 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:50 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) [ 267.502682][T24037] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 267.546598][T24037] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 267.555099][T24037] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:50 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00h\x00\x00', 0x0) [ 267.587557][T24036] loop2: p1 p2 p3 p4 [ 267.591925][T24036] loop2: p1 size 78398975 extends beyond EOD, truncated 11:01:50 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00l\x00\x00', 0x0) [ 267.643232][T24036] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 267.669473][T24036] loop2: p3 start 2127165541 is beyond EOD, truncated [ 267.676294][T24036] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:01:51 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:51 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:51 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00t\x00\x00', 0x0) 11:01:51 executing program 2: syz_read_part_table(0x3f00, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 268.308864][T24034] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 268.317324][T24034] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 268.346378][T24034] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:01:51 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00z\x00\x00', 0x0) [ 268.354982][T24034] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:51 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x01', 0x0) 11:01:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 268.456320][T24115] loop2: detected capacity change from 0 to 31 [ 268.488205][T24115] loop2: p1 p2 p3 p4 [ 268.493116][T24115] loop2: p1 size 78398975 extends beyond EOD, truncated 11:01:51 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:01:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:51 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x02', 0x0) [ 268.565276][T24115] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:01:51 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 268.619767][T24115] loop2: p3 start 2127165541 is beyond EOD, truncated [ 268.626674][T24115] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 268.693590][T24132] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 268.702341][T24132] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 268.713869][T24115] loop2: detected capacity change from 0 to 31 [ 268.749418][T24132] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 268.758146][T24132] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 268.771235][T24115] loop2: p1 p2 p3 p4 [ 268.775456][T24115] loop2: p1 size 78398975 extends beyond EOD, truncated [ 268.829246][T24115] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 268.843838][T24115] loop2: p3 start 2127165541 is beyond EOD, truncated [ 268.853932][T24115] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 268.977053][T24171] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 268.985778][T24171] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 269.060597][T24171] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 269.069103][T24171] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:52 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:52 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x03', 0x0) 11:01:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:52 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:52 executing program 2: syz_read_part_table(0x4000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:01:52 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x04', 0x0) 11:01:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:52 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 269.304689][T24184] loop2: detected capacity change from 0 to 32 [ 269.339077][T24184] loop2: p1 p2 p3 p4 [ 269.347691][T24184] loop2: p1 size 78398975 extends beyond EOD, truncated [ 269.389088][T24184] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 269.405186][T24184] loop2: p3 start 2127165541 is beyond EOD, truncated [ 269.412145][T24184] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 269.506153][T24184] loop2: detected capacity change from 0 to 32 11:01:52 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:01:52 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x05', 0x0) 11:01:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:52 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 269.562495][T24215] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 269.571032][T24215] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 269.583253][T24184] loop2: p1 p2 p3 p4 [ 269.587373][T24184] loop2: p1 size 78398975 extends beyond EOD, truncated [ 269.616118][T24184] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 269.638628][T24184] loop2: p3 start 2127165541 is beyond EOD, truncated [ 269.640754][T24215] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 269.645636][T24184] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 269.654087][T24215] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 269.760474][ T1033] loop2: p1 p2 p3 p4 [ 269.764808][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 269.788612][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 269.812411][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 269.819267][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 269.900796][T24245] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 269.909307][T24245] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 269.941082][T24245] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 269.949691][T24245] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:53 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:53 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x06', 0x0) 11:01:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:53 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:53 executing program 2: syz_read_part_table(0x4602, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:01:53 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\a', 0x0) [ 270.191340][T24277] loop2: detected capacity change from 0 to 35 11:01:53 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\b', 0x0) 11:01:53 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 270.236341][T24277] loop2: p1 p2 p3 p4 [ 270.240711][T24277] loop2: p1 size 78398975 extends beyond EOD, truncated [ 270.248405][T24277] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 270.256357][T24277] loop2: p3 start 2127165541 is beyond EOD, truncated [ 270.263308][T24277] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:01:53 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:53 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\t', 0x0) 11:01:53 executing program 2: syz_read_part_table(0x4800, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:01:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 270.444351][T24307] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 270.453039][T24307] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 270.501000][T24307] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 270.509748][T24307] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 270.584420][T24324] loop2: detected capacity change from 0 to 36 [ 270.628330][T24324] loop2: p1 p2 p3 p4 [ 270.632789][T24324] loop2: p1 size 78398975 extends beyond EOD, truncated [ 270.641051][T24324] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 270.648861][T24324] loop2: p3 start 2127165541 is beyond EOD, truncated [ 270.655679][T24324] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 270.716247][T24340] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 270.724801][T24340] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 270.752849][T24340] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 270.761409][T24340] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 270.891276][T24324] loop2: detected capacity change from 0 to 36 11:01:54 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\n', 0x0) 11:01:54 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:54 executing program 2: syz_read_part_table(0x4c00, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:01:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\v', 0x0) [ 270.983739][T24324] loop2: p1 p2 p3 p4 [ 270.988038][T24324] loop2: p1 size 78398975 extends beyond EOD, truncated [ 270.996602][T24324] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 271.005008][T24324] loop2: p3 start 2127165541 is beyond EOD, truncated [ 271.011835][T24324] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 271.239819][T24384] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 271.248282][T24384] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 271.279837][T24384] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:01:54 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 271.288654][T24384] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\f', 0x0) 11:01:54 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\r', 0x0) 11:01:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:54 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 271.475942][T24383] loop2: detected capacity change from 0 to 38 [ 271.529844][T24383] loop2: p1 p2 p3 p4 [ 271.535508][T24383] loop2: p1 size 78398975 extends beyond EOD, truncated [ 271.591227][T24383] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 271.663370][T24417] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 271.671854][T24417] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 271.709248][T24417] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 271.718147][T24417] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 271.734070][T24383] loop2: p3 start 2127165541 is beyond EOD, truncated [ 271.740916][T24383] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:01:54 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x0e', 0x0) 11:01:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:54 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:54 executing program 2: syz_read_part_table(0x6000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:01:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x0f', 0x0) 11:01:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x10', 0x0) [ 271.962142][T24433] loop2: detected capacity change from 0 to 48 11:01:54 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 272.022357][T24433] loop2: p1 p2 p3 p4 [ 272.028822][T24433] loop2: p1 size 78398975 extends beyond EOD, truncated [ 272.129737][T24456] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 272.138303][T24456] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 272.170643][T24456] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 272.179356][T24456] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 272.206165][T24433] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 272.268538][T24433] loop2: p3 start 2127165541 is beyond EOD, truncated [ 272.275543][T24433] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:01:55 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:55 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:55 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x11', 0x0) 11:01:55 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 272.456134][T24433] loop2: detected capacity change from 0 to 48 [ 272.520682][ T1033] loop2: p1 p2 p3 p4 [ 272.529117][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 272.568303][T24492] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 272.576800][T24492] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 272.604410][T24492] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 272.613044][T24492] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 272.642823][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 272.653915][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 272.660942][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 272.698527][T24433] loop2: p1 p2 p3 p4 [ 272.702943][T24433] loop2: p1 size 78398975 extends beyond EOD, truncated [ 272.711170][T24433] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 272.719791][T24433] loop2: p3 start 2127165541 is beyond EOD, truncated [ 272.726776][T24433] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:01:55 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:55 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x12', 0x0) 11:01:55 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:55 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:55 executing program 2: syz_read_part_table(0x6800, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:01:55 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00H', 0x0) 11:01:55 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00L', 0x0) [ 272.770443][ T1033] loop2: p1 p2 p3 p4 [ 272.775273][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 272.785163][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 272.793000][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 272.800325][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:01:55 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 273.166262][T24546] loop2: detected capacity change from 0 to 52 11:01:56 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:01:56 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00h', 0x0) 11:01:56 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:56 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:56 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00l', 0x0) [ 273.231817][T24546] loop2: p1 p2 p3 p4 [ 273.241764][T24546] loop2: p1 size 78398975 extends beyond EOD, truncated [ 273.249940][T24546] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 273.259928][T24546] loop2: p3 start 2127165541 is beyond EOD, truncated [ 273.266855][T24546] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:01:56 executing program 2: syz_read_part_table(0x6c00, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 273.404074][T24585] loop2: detected capacity change from 0 to 54 [ 273.471761][T24585] loop2: p1 p2 p3 p4 [ 273.482341][T24585] loop2: p1 size 78398975 extends beyond EOD, truncated [ 273.509750][T24585] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 273.517611][T24585] loop2: p3 start 2127165541 is beyond EOD, truncated [ 273.524436][T24585] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 273.600516][T24585] loop2: detected capacity change from 0 to 54 [ 273.702141][T24517] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 273.710789][T24517] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 273.738184][T24517] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:01:56 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:56 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:56 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:56 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00t', 0x0) 11:01:56 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:56 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00z', 0x0) [ 273.746824][T24517] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 273.760220][T24585] loop2: p1 p2 p3 p4 [ 273.764271][T24585] loop2: p1 size 78398975 extends beyond EOD, truncated [ 273.772836][T24585] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 273.781628][T24585] loop2: p3 start 2127165541 is beyond EOD, truncated [ 273.788808][T24585] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:01:57 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:57 executing program 2: syz_read_part_table(0x7400, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:01:57 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\xff\xff\xff\xfe', 0x0) 11:01:57 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:01:57 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:57 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\xfe\xff\xff\xff', 0x0) [ 274.234910][T24652] loop2: detected capacity change from 0 to 58 [ 274.298557][T24652] loop2: p1 p2 p3 p4 [ 274.303519][T24652] loop2: p1 size 78398975 extends beyond EOD, truncated [ 274.312097][T24652] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 274.322771][T24652] loop2: p3 start 2127165541 is beyond EOD, truncated [ 274.330027][T24652] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:01:57 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x0, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:57 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:57 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:57 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:01:57 executing program 2: syz_read_part_table(0x7a00, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 274.686878][T24612] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 274.695853][T24612] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 274.721329][T24612] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:01:57 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 274.731118][T24612] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:57 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:57 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 274.790086][T24691] loop2: detected capacity change from 0 to 61 11:01:57 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 274.968193][T24691] loop2: p1 p2 p3 p4 [ 274.972505][T24691] loop2: p1 size 78398975 extends beyond EOD, truncated 11:01:58 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) [ 275.020292][T24691] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:01:58 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:01:58 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x0, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 275.081957][T24691] loop2: p3 start 2127165541 is beyond EOD, truncated [ 275.089833][T24691] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 275.093555][T24688] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 275.106649][T24688] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:58 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:58 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 275.151284][T24688] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 275.159977][T24688] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:58 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x0, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:58 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 275.267924][T24691] loop2: detected capacity change from 0 to 61 [ 275.288763][T24691] loop2: p1 p2 p3 p4 [ 275.296595][T24691] loop2: p1 size 78398975 extends beyond EOD, truncated [ 275.306127][T24691] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 275.352080][T24691] loop2: p3 start 2127165541 is beyond EOD, truncated [ 275.358944][T24691] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 275.429486][T24760] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 275.438011][T24760] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:01:58 executing program 2: syz_read_part_table(0x8004, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:01:58 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:58 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:01:58 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:58 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 275.586632][T24760] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 275.596465][T24760] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 275.803186][T24794] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 275.811866][T24794] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 275.842174][T24794] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 275.850737][T24794] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 275.905586][T24792] loop2: detected capacity change from 0 to 64 [ 276.048924][T24792] loop2: p1 p2 p3 p4 [ 276.053119][T24792] loop2: p1 size 78398975 extends beyond EOD, truncated [ 276.061051][T24792] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 276.069315][T24792] loop2: p3 start 2127165541 is beyond EOD, truncated [ 276.076188][T24792] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:01:59 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:59 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:01:59 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:59 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:59 executing program 2: syz_read_part_table(0x9000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:01:59 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:01:59 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:01:59 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 276.252590][T24821] loop2: detected capacity change from 0 to 72 [ 276.417748][T24840] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 276.426219][T24840] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 276.462012][T24840] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 276.470509][T24840] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 276.484229][T24821] loop2: p1 p2 p3 p4 [ 276.488583][T24821] loop2: p1 size 78398975 extends beyond EOD, truncated 11:01:59 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:01:59 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:01:59 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 276.630128][T24821] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 276.690176][T24821] loop2: p3 start 2127165541 is beyond EOD, truncated [ 276.697089][T24821] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:01:59 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r0, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 276.775998][T24859] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 276.784566][T24859] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 276.816666][T24859] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 276.825158][T24859] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 276.979248][T24821] loop2: detected capacity change from 0 to 72 11:02:00 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:00 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:00 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r0, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:00 executing program 2: syz_read_part_table(0xb20f, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 277.038688][T24821] loop2: p1 p2 p3 p4 [ 277.048400][T24821] loop2: p1 size 78398975 extends beyond EOD, truncated [ 277.056357][T24821] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 277.064633][T24821] loop2: p3 start 2127165541 is beyond EOD, truncated [ 277.071853][T24821] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 277.109225][ T1033] loop2: p1 p2 p3 p4 [ 277.125646][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 277.135726][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 277.144105][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 277.151101][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:00 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r0, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 277.221673][T24908] loop2: detected capacity change from 0 to 89 [ 277.342962][T24927] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 277.351443][T24927] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 277.386422][T24927] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 277.395035][T24927] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:00 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:00 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 277.553707][T24908] loop2: p1 p2 p3 p4 [ 277.560035][T24908] loop2: p1 size 78398975 extends beyond EOD, truncated [ 277.587264][T24908] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 277.619926][T24908] loop2: p3 start 2127165541 is beyond EOD, truncated [ 277.627553][T24908] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 277.745540][T24952] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 277.754049][T24952] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 277.790998][T24952] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 277.799498][T24952] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:00 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:00 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:00 executing program 2: syz_read_part_table(0xb30f, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:01 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:01 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 278.078904][T24973] loop2: detected capacity change from 0 to 89 [ 278.205106][T24979] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 278.213645][T24979] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 278.249769][T24979] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 278.258357][T24979] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:01 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, 0x0, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:01 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 278.427551][T24973] loop2: p1 p2 p3 p4 [ 278.433838][T24973] loop2: p1 size 78398975 extends beyond EOD, truncated [ 278.460258][T24973] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 278.469145][T24973] loop2: p3 start 2127165541 is beyond EOD, truncated 11:02:01 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 278.475961][T24973] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 278.618474][T25012] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 278.626954][T25012] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 278.656200][T25012] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 278.664791][T25012] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:01 executing program 2: syz_read_part_table(0xb40f, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:01 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:01 executing program 5: setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:01 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:01 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:01 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:01 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:01 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 278.958652][T25036] loop2: detected capacity change from 0 to 90 [ 279.007801][T25036] loop2: p1 p2 p3 p4 [ 279.016295][T25036] loop2: p1 size 78398975 extends beyond EOD, truncated [ 279.024024][T25036] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 279.032035][T25036] loop2: p3 start 2127165541 is beyond EOD, truncated [ 279.038907][T25036] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:02 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, 0x0, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:02 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:02 executing program 2: syz_read_part_table(0xb502, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:02 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:02 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:02 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:02 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 279.376157][T25087] loop2: detected capacity change from 0 to 90 [ 279.407494][T25087] loop2: p1 p2 p3 p4 [ 279.413248][T25087] loop2: p1 size 78398975 extends beyond EOD, truncated [ 279.487451][T25087] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 279.504560][T25087] loop2: p3 start 2127165541 is beyond EOD, truncated [ 279.511408][T25087] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:02 executing program 5: setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:02 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:02 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:02 executing program 2: syz_read_part_table(0xb50f, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:02 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 279.835585][T25139] loop2: detected capacity change from 0 to 90 [ 279.892563][T25139] loop2: p1 p2 p3 p4 [ 279.897189][T25139] loop2: p1 size 78398975 extends beyond EOD, truncated [ 279.906936][T25139] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 279.914750][T25139] loop2: p3 start 2127165541 is beyond EOD, truncated [ 279.921588][T25139] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:03 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, 0x0, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:03 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x02\x00\x00', 0x0) 11:02:03 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:03 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, 0x0, 0x0) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:03 executing program 2: syz_read_part_table(0xb60f, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 280.213418][T25085] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 280.222195][T25085] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 280.248487][T25085] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:03 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x03\x00\x00', 0x0) [ 280.257347][T25085] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:03 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 280.337279][T25176] loop2: detected capacity change from 0 to 91 [ 280.438852][T25191] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 280.447458][T25191] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 280.475078][T25191] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 280.483646][T25191] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 280.498735][T25176] loop2: p1 p2 p3 p4 [ 280.510036][T25176] loop2: p1 size 78398975 extends beyond EOD, truncated [ 280.542011][T25176] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 280.570853][T25176] loop2: p3 start 2127165541 is beyond EOD, truncated [ 280.577780][T25176] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:03 executing program 5: setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:03 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, 0x0, 0x0) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:03 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x04\x00\x00', 0x0) 11:02:03 executing program 2: syz_read_part_table(0xd401, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:03 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 280.729420][T25219] loop2: detected capacity change from 0 to 106 [ 280.797182][T25219] loop2: p1 p2 p3 p4 [ 280.802893][T25219] loop2: p1 size 78398975 extends beyond EOD, truncated [ 280.821354][T25219] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 280.838960][T25219] loop2: p3 start 2127165541 is beyond EOD, truncated [ 280.846298][T25219] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 280.947290][T25236] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 280.955815][T25236] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 281.041627][T25236] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 281.050201][T25236] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:04 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:04 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x05\x00\x00', 0x0) 11:02:04 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:04 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, 0x0, 0x0) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:04 executing program 2: syz_read_part_table(0xd526, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:04 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x06\x00\x00', 0x0) 11:02:04 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 281.201068][T25259] loop2: detected capacity change from 0 to 106 [ 281.353560][T25269] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 281.362494][T25269] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 281.389949][T25269] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 281.398453][T25269] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:04 executing program 5: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:04 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:04 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:04 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\a\x00\x00', 0x0) [ 281.511694][T25259] loop2: p1 p2 p3 p4 [ 281.516208][T25259] loop2: p1 size 78398975 extends beyond EOD, truncated [ 281.523659][T25259] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 281.532032][T25259] loop2: p3 start 2127165541 is beyond EOD, truncated [ 281.539005][T25259] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:04 executing program 2: syz_read_part_table(0xf504, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:04 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\b\x00\x00', 0x0) 11:02:04 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 281.711173][T25308] loop2: detected capacity change from 0 to 122 [ 281.766559][T25308] loop2: p1 p2 p3 p4 [ 281.770945][T25308] loop2: p1 size 78398975 extends beyond EOD, truncated [ 281.814713][T25308] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 281.839716][T25308] loop2: p3 start 2127165541 is beyond EOD, truncated [ 281.846594][T25308] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 281.876265][T25312] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 281.884831][T25312] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 281.916282][T25312] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 281.924754][T25312] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 281.947691][T25322] print_req_error: 27 callbacks suppressed [ 281.947704][T25322] blk_update_request: I/O error, dev loop2, sector 18 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 281.949341][T25330] blk_update_request: I/O error, dev loop2, sector 8 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 281.953716][ T853] blk_update_request: I/O error, dev loop2, sector 18 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 281.987478][ T853] buffer_io_error: 20 callbacks suppressed [ 281.987494][ T853] Buffer I/O error on dev loop2p1, logical block 1, async page read [ 282.001330][ T853] blk_update_request: I/O error, dev loop2, sector 8 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 282.007501][T25308] __loop_clr_fd: partition scan of loop2 failed (rc=-16) [ 282.012323][ T853] Buffer I/O error on dev loop2p2, logical block 4, async page read [ 282.027474][ T853] blk_update_request: I/O error, dev loop2, sector 10 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 282.037210][T25331] blk_update_request: I/O error, dev loop2, sector 8 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 282.038532][ T853] Buffer I/O error on dev loop2p2, logical block 5, async page read [ 282.057843][ T853] blk_update_request: I/O error, dev loop2, sector 12 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 282.068859][ T853] Buffer I/O error on dev loop2p2, logical block 6, async page read 11:02:05 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:05 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:05 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:05 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\t\x00\x00', 0x0) [ 282.076929][ T853] blk_update_request: I/O error, dev loop2, sector 14 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 282.088382][ T853] Buffer I/O error on dev loop2p2, logical block 7, async page read [ 282.110846][ T853] blk_update_request: I/O error, dev loop2, sector 8 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 282.121788][ T853] Buffer I/O error on dev loop2p4, logical block 4, async page read [ 282.129938][ T853] blk_update_request: I/O error, dev loop2, sector 10 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 282.133352][T25308] loop2: detected capacity change from 0 to 122 [ 282.141117][ T853] Buffer I/O error on dev loop2p4, logical block 5, async page read [ 282.141236][ T853] Buffer I/O error on dev loop2p4, logical block 6, async page read [ 282.163806][ T853] Buffer I/O error on dev loop2p4, logical block 7, async page read 11:02:05 executing program 2: syz_read_part_table(0xff0f, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 282.356100][T25356] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 282.364605][T25356] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 282.413115][T25356] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 282.421874][T25356] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:05 executing program 5: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:05 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\n\x00\x00', 0x0) 11:02:05 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:05 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:05 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\v\x00\x00', 0x0) [ 282.462117][ T616] Buffer I/O error on dev loop2p1, logical block 1, async page read [ 282.516407][T25362] loop2: detected capacity change from 0 to 127 11:02:05 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\f\x00\x00', 0x0) 11:02:05 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 282.583961][T25362] loop2: p1 p2 p3 p4 [ 282.588199][T25362] loop2: p1 size 78398975 extends beyond EOD, truncated [ 282.596021][T25362] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 282.603976][T25362] loop2: p3 start 2127165541 is beyond EOD, truncated [ 282.610864][T25362] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 282.692628][T25362] loop2: detected capacity change from 0 to 127 [ 282.737339][T25362] loop2: p1 p2 p3 p4 [ 282.743757][T25362] loop2: p1 size 78398975 extends beyond EOD, truncated [ 282.774528][T25362] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 282.802060][T25362] loop2: p3 start 2127165541 is beyond EOD, truncated [ 282.808922][T25362] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 282.870637][T25412] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 282.879276][T25412] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:05 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:05 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\r\x00\x00', 0x0) 11:02:05 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:05 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:05 executing program 2: syz_read_part_table(0x20000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 282.946273][T25412] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 282.954745][T25412] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 283.095756][T25435] loop2: detected capacity change from 0 to 256 [ 283.138795][T25435] loop2: p1 p2 p3 p4 [ 283.143123][T25435] loop2: p1 size 78398975 extends beyond EOD, truncated [ 283.182360][T25435] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 283.236171][T25444] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 283.244715][T25444] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 283.272916][T25444] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 283.281484][T25444] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 283.322011][T25435] loop2: p3 start 2127165541 is beyond EOD, truncated [ 283.328914][T25435] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:06 executing program 5: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:06 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x0e\x00\x00', 0x0) 11:02:06 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:06 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:06 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x0f\x00\x00', 0x0) 11:02:06 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 283.460717][T25435] loop2: detected capacity change from 0 to 256 11:02:06 executing program 2: syz_read_part_table(0x40000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 283.682134][T25488] loop2: detected capacity change from 0 to 512 [ 283.721257][T25486] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 283.729864][T25486] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 283.742255][T25488] loop2: p1 p2 p3 p4 [ 283.746825][T25488] loop2: p1 size 78398975 extends beyond EOD, truncated [ 283.755022][T25488] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 283.771540][T25488] loop2: p3 start 2127165541 is beyond EOD, truncated [ 283.778372][T25488] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 283.793843][T25486] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 283.802438][T25486] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:06 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:06 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:06 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x10\x00\x00', 0x0) 11:02:06 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 283.904373][T25488] loop2: detected capacity change from 0 to 512 11:02:06 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x11\x00\x00', 0x0) [ 283.983682][T25488] loop2: p1 p2 p3 p4 [ 283.987980][T25488] loop2: p1 size 78398975 extends beyond EOD, truncated [ 284.065476][T25488] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 284.112739][T25521] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 284.121257][T25521] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 284.148526][T25521] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 284.156988][T25521] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 284.205637][T25488] loop2: p3 start 2127165541 is beyond EOD, truncated [ 284.212502][T25488] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:07 executing program 5: prlimit64(0x0, 0xe, 0x0, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:07 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:07 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x12\x00\x00', 0x0) 11:02:07 executing program 2: syz_read_part_table(0x80000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:07 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:07 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00H\x00\x00', 0x0) 11:02:07 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 284.437774][T25543] loop2: detected capacity change from 0 to 1024 [ 284.506512][T25543] loop2: p1 p2 p3 p4 [ 284.510677][T25543] loop2: p1 size 78398975 extends beyond EOD, truncated [ 284.531121][T25543] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 284.560533][T25543] loop2: p3 start 2127165541 is beyond EOD, truncated [ 284.567648][T25543] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 284.635101][T25562] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 284.643609][T25562] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 284.696023][T25562] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 284.704520][T25562] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:07 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:07 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:07 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00L\x00\x00', 0x0) 11:02:07 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:07 executing program 2: syz_read_part_table(0x100000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 284.870988][T25586] loop2: detected capacity change from 0 to 2048 [ 284.989779][T25599] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 284.998331][T25599] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 285.025818][T25599] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 285.034269][T25599] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 285.056281][T25586] loop2: p1 p2 p3 p4 [ 285.067622][T25586] loop2: p1 size 78398975 extends beyond EOD, truncated [ 285.092604][T25586] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 285.119283][T25586] loop2: p3 start 2127165541 is beyond EOD, truncated [ 285.126327][T25586] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:08 executing program 5: prlimit64(0x0, 0xe, 0x0, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:08 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00h\x00\x00', 0x0) 11:02:08 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:08 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:08 executing program 2: syz_read_part_table(0x200000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:08 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00l\x00\x00', 0x0) 11:02:08 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 285.306890][T25626] loop2: detected capacity change from 0 to 4096 [ 285.329283][T25626] loop2: p1 p2 p3 p4 [ 285.337324][T25626] loop2: p1 size 78398975 extends beyond EOD, truncated [ 285.377207][T25626] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 285.388145][T25626] loop2: p3 start 2127165541 is beyond EOD, truncated [ 285.395009][T25626] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 285.446415][ T1033] loop2: p1 p2 p3 p4 [ 285.452772][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 285.473026][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 285.488722][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 285.495562][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 285.511587][T25638] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 285.520080][T25638] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 285.563313][T25638] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 285.571925][T25638] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:08 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:08 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:08 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00t\x00\x00', 0x0) 11:02:08 executing program 2: syz_read_part_table(0x900000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:08 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 285.766891][T25673] loop2: detected capacity change from 0 to 18432 [ 285.873531][T25681] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 285.882008][T25681] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 285.910903][T25681] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 285.919448][T25681] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:09 executing program 5: prlimit64(0x0, 0xe, 0x0, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:09 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:09 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00z\x00\x00', 0x0) 11:02:09 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:09 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x03\x00', 0x0) [ 286.045910][T25673] loop2: p1 p2 p3 p4 [ 286.050099][T25673] loop2: p1 size 78398975 extends beyond EOD, truncated [ 286.057901][T25673] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 286.065817][T25673] loop2: p3 start 2127165541 is beyond EOD, truncated [ 286.072606][T25673] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:09 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:09 executing program 2: syz_read_part_table(0xe0ffff, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 286.128969][T25673] loop2: detected capacity change from 0 to 18432 [ 286.321313][T25722] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 286.329826][T25722] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 286.361923][T25722] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 286.370440][T25722] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 286.433066][T25725] loop2: detected capacity change from 0 to 28799 11:02:09 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:09 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:09 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x05\x00', 0x0) 11:02:09 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:09 executing program 2: syz_read_part_table(0x1000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 286.485446][T25725] loop2: p1 p2 p3 p4 [ 286.489651][T25725] loop2: p1 size 78398975 extends beyond EOD, truncated [ 286.497705][T25725] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 286.505802][T25725] loop2: p3 start 2127165541 is beyond EOD, truncated [ 286.512665][T25725] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 286.649601][T25751] loop2: detected capacity change from 0 to 32768 [ 286.706209][T25751] loop2: p1 p2 p3 p4 [ 286.712997][T25751] loop2: p1 size 78398975 extends beyond EOD, truncated [ 286.735787][T25751] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 286.755058][T25751] loop2: p3 start 2127165541 is beyond EOD, truncated [ 286.761855][T25751] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 286.832700][T25763] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 286.841323][T25763] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 286.926159][T25763] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 286.934621][T25763] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:10 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:10 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x06\x00', 0x0) 11:02:10 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:10 executing program 2: syz_read_part_table(0x2000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:10 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:10 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:10 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\a\x00', 0x0) [ 287.166053][T25790] loop2: detected capacity change from 0 to 65536 [ 287.208254][T25790] loop2: p1 p2 p3 p4 [ 287.218668][T25790] loop2: p1 size 78398975 extends beyond EOD, truncated [ 287.227229][T25790] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 287.255234][T25790] loop2: p3 start 2127165541 is beyond EOD, truncated [ 287.262147][T25790] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:10 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:10 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:10 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\t\x00', 0x0) 11:02:10 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:10 executing program 2: syz_read_part_table(0x2040000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:10 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\n\x00', 0x0) 11:02:10 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:10 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\v\x00', 0x0) 11:02:10 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 287.543796][T25829] loop2: detected capacity change from 0 to 66048 [ 287.606807][T25829] loop2: p1 p2 p3 p4 [ 287.611077][T25829] loop2: p1 size 78398975 extends beyond EOD, truncated [ 287.632937][T25829] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 287.687459][T25829] loop2: p3 start 2127165541 is beyond EOD, truncated [ 287.694285][T25829] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 287.807490][T25829] loop2: detected capacity change from 0 to 66048 [ 287.855309][T25829] loop2: p1 p2 p3 p4 [ 287.859625][T25829] loop2: p1 size 78398975 extends beyond EOD, truncated [ 287.880105][T25829] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 287.899697][T25829] loop2: p3 start 2127165541 is beyond EOD, truncated [ 287.906501][T25829] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 287.964567][T25773] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 287.973238][T25773] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 288.003347][T25773] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 288.011839][T25773] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 288.056820][T25836] print_req_error: 14 callbacks suppressed [ 288.056835][T25836] blk_update_request: I/O error, dev loop2, sector 65920 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 288.076190][T25839] blk_update_request: I/O error, dev loop2, sector 65920 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 288.088815][ T1787] __loop_clr_fd: partition scan of loop2 failed (rc=-16) 11:02:11 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:11 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\f\x00', 0x0) 11:02:11 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 288.090372][T25863] blk_update_request: I/O error, dev loop2, sector 65802 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 288.124429][ T616] blk_update_request: I/O error, dev loop2, sector 65920 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 288.135805][ T616] buffer_io_error: 8 callbacks suppressed [ 288.135819][ T616] Buffer I/O error on dev loop2p4, logical block 8240, async page read [ 288.178851][ T853] blk_update_request: I/O error, dev loop2, sector 65802 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 288.190201][ T853] Buffer I/O error on dev loop2p1, logical block 32896, async page read [ 288.198873][ T853] blk_update_request: I/O error, dev loop2, sector 65804 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 288.210168][ T853] Buffer I/O error on dev loop2p1, logical block 32897, async page read [ 288.218663][ T853] blk_update_request: I/O error, dev loop2, sector 65920 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 288.229955][ T853] Buffer I/O error on dev loop2p2, logical block 8240, async page read [ 288.238235][ T853] blk_update_request: I/O error, dev loop2, sector 65806 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 288.249473][ T853] Buffer I/O error on dev loop2p1, logical block 32898, async page read [ 288.257934][ T853] blk_update_request: I/O error, dev loop2, sector 65808 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 288.269222][ T853] Buffer I/O error on dev loop2p1, logical block 32899, async page read [ 288.302210][T25836] blk_update_request: I/O error, dev loop2, sector 65920 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 288.316139][ T616] Buffer I/O error on dev loop2p4, logical block 8240, async page read [ 288.331911][ T616] Buffer I/O error on dev loop2p1, logical block 32896, async page read [ 288.341592][ T616] Buffer I/O error on dev loop2p1, logical block 32897, async page read 11:02:11 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:11 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:11 executing program 2: syz_read_part_table(0x3000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:11 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:11 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\r\x00', 0x0) [ 288.351067][ T616] Buffer I/O error on dev loop2p1, logical block 32898, async page read 11:02:11 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:11 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:11 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x0e\x00', 0x0) [ 288.475281][T25905] loop2: detected capacity change from 0 to 98304 11:02:11 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 288.539974][T25905] loop2: p1 p2 p3 p4 [ 288.556207][T25905] loop2: p1 size 78398975 extends beyond EOD, truncated [ 288.601205][T25905] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 288.609128][T25905] loop2: p3 start 2127165541 is beyond EOD, truncated [ 288.615967][T25905] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 288.707550][T25905] loop2: detected capacity change from 0 to 98304 [ 288.745424][T25905] loop2: p1 p2 p3 p4 [ 288.749534][T25905] loop2: p1 size 78398975 extends beyond EOD, truncated [ 288.756945][T25905] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 288.764953][T25905] loop2: p3 start 2127165541 is beyond EOD, truncated [ 288.771781][T25905] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 289.036984][T25885] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 289.045457][T25885] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:12 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:12 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x0f\x00', 0x0) 11:02:12 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 289.078335][T25885] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 289.086812][T25885] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:12 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:12 executing program 2: syz_read_part_table(0x4000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:12 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:12 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x11\x00', 0x0) 11:02:12 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 289.278893][T25975] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 289.287495][T25975] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:12 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 289.346482][T25975] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 289.355049][T25975] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:12 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x12\x00', 0x0) 11:02:12 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 289.393978][T25982] loop2: detected capacity change from 0 to 131072 11:02:12 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00H\x00', 0x0) [ 289.476156][T25982] loop2: p1 p2 p3 p4 [ 289.480323][T25982] loop2: p1 size 78398975 extends beyond EOD, truncated [ 289.517672][T25982] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 289.564841][T25982] loop2: p3 start 2127165541 is beyond EOD, truncated [ 289.571709][T25982] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 289.721784][T26007] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 289.730277][T26007] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 289.843760][T26007] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 289.852267][T26007] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:12 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00L\x00', 0x0) 11:02:12 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:12 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:13 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:13 executing program 2: syz_read_part_table(0x5000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:13 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00h\x00', 0x0) 11:02:13 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:13 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x0, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:13 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:13 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00l\x00', 0x0) 11:02:13 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00t\x00', 0x0) [ 290.295121][T26054] loop2: detected capacity change from 0 to 163840 11:02:13 executing program 2: syz_read_part_table(0x6000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:13 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00z\x00', 0x0) 11:02:13 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:13 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x0, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 290.339168][T26054] loop2: p1 p2 p3 p4 [ 290.343401][T26054] loop2: p1 size 78398975 extends beyond EOD, truncated [ 290.354454][T26054] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 290.363166][T26054] loop2: p3 start 2127165541 is beyond EOD, truncated [ 290.370063][T26054] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 290.514519][T26092] loop2: detected capacity change from 0 to 196608 [ 290.575250][T26092] loop2: p1 p2 p3 p4 [ 290.579445][T26092] loop2: p1 size 78398975 extends beyond EOD, truncated [ 290.587461][T26092] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 290.595836][T26092] loop2: p3 start 2127165541 is beyond EOD, truncated [ 290.602753][T26092] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 290.616692][T26072] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 290.625198][T26072] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 290.745224][T26072] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 290.753757][T26072] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 290.765450][T26092] loop2: detected capacity change from 0 to 196608 [ 290.805767][ T1033] loop2: p1 p2 p3 p4 [ 290.809941][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 290.833721][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 290.869481][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 290.876502][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 290.916229][T26092] loop2: p1 p2 p3 p4 [ 290.920288][T26092] loop2: p1 size 78398975 extends beyond EOD, truncated [ 290.947689][T26092] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 290.974866][T26092] loop2: p3 start 2127165541 is beyond EOD, truncated [ 290.981856][T26092] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 291.178577][T26043] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 291.187221][T26043] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:14 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:14 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:14 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:14 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x0, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:14 executing program 2: syz_read_part_table(0x6040000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:14 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:14 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 291.232292][T26043] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 291.240881][T26043] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:14 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:14 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:14 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x0, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 291.329482][T26143] loop2: detected capacity change from 0 to 197120 [ 291.375438][T26143] loop2: p1 p2 p3 p4 [ 291.379723][T26143] loop2: p1 size 78398975 extends beyond EOD, truncated [ 291.404778][T26143] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 291.415221][T26143] loop2: p3 start 2127165541 is beyond EOD, truncated 11:02:14 executing program 2: syz_read_part_table(0x7000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:14 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 291.422014][T26143] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 291.668516][T26167] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 291.677003][T26167] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 291.743375][T26167] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 291.751869][T26167] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 291.805997][T26187] loop2: detected capacity change from 0 to 229376 [ 291.876926][T26187] loop2: p1 p2 p3 p4 [ 291.884090][T26187] loop2: p1 size 78398975 extends beyond EOD, truncated [ 291.915104][T26187] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 291.939706][T26187] loop2: p3 start 2127165541 is beyond EOD, truncated [ 291.946711][T26187] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:15 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:15 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:15 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x0, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:15 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:15 executing program 2: syz_read_part_table(0x8000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:15 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x0, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:15 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:15 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 292.227562][T26216] loop2: detected capacity change from 0 to 262144 11:02:15 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 292.287020][T26216] loop2: p1 p2 p3 p4 [ 292.291527][T26216] loop2: p1 size 78398975 extends beyond EOD, truncated [ 292.306187][T26216] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 292.328848][T26216] loop2: p3 start 2127165541 is beyond EOD, truncated 11:02:15 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x0, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:15 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 292.335712][T26216] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:15 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:16 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:16 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:16 executing program 2: syz_read_part_table(0x9000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:16 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:16 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x0, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 293.091723][T26206] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 293.100232][T26206] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:16 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x0, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:16 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:16 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 293.151343][T26206] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 293.159915][T26206] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 293.184989][T26281] loop2: detected capacity change from 0 to 264192 11:02:16 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x0, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 293.247550][T26281] loop2: p1 p2 p3 p4 [ 293.256309][T26281] loop2: p1 size 78398975 extends beyond EOD, truncated [ 293.362243][T26305] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 293.370887][T26305] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 293.405690][T26305] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 293.414148][T26305] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 293.447126][T26281] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:02:16 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:16 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0), 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 293.519064][T26281] loop2: p3 start 2127165541 is beyond EOD, truncated [ 293.525937][T26281] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:16 executing program 2: syz_read_part_table(0xa000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 293.702147][T26325] loop2: detected capacity change from 0 to 264192 [ 293.725566][T26313] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 293.734049][T26313] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 293.765779][T26325] loop2: p1 p2 p3 p4 [ 293.769992][T26325] loop2: p1 size 78398975 extends beyond EOD, truncated [ 293.784302][T26325] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 293.792382][T26325] loop2: p3 start 2127165541 is beyond EOD, truncated [ 293.799022][T26313] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 293.799192][T26325] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 293.807628][T26313] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:17 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:17 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x0, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:17 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:17 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0), 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:17 executing program 2: syz_read_part_table(0xb000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 294.094104][T26350] loop2: detected capacity change from 0 to 264192 [ 294.164870][T26350] loop2: p1 p2 p3 p4 [ 294.175609][T26350] loop2: p1 size 78398975 extends beyond EOD, truncated [ 294.184932][T26350] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 294.193730][T26350] loop2: p3 start 2127165541 is beyond EOD, truncated [ 294.200571][T26350] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:17 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x0, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:17 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:17 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0), 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:17 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:17 executing program 2: syz_read_part_table(0xc000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:17 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:17 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 294.514769][T26388] loop2: detected capacity change from 0 to 264192 [ 294.566043][T26388] loop2: p1 p2 p3 p4 [ 294.572276][T26388] loop2: p1 size 78398975 extends beyond EOD, truncated [ 294.580779][T26388] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 294.589612][T26388] loop2: p3 start 2127165541 is beyond EOD, truncated [ 294.596451][T26388] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:17 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:17 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0x0, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:17 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:17 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:17 executing program 2: syz_read_part_table(0xd000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 294.928657][T26343] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 294.937278][T26343] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 294.963373][T26343] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 294.972029][T26343] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 295.026940][T26422] loop2: detected capacity change from 0 to 264192 [ 295.078445][T26422] loop2: p1 p2 p3 p4 [ 295.082738][T26422] loop2: p1 size 78398975 extends beyond EOD, truncated [ 295.116927][T26422] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 295.127073][T26422] loop2: p3 start 2127165541 is beyond EOD, truncated [ 295.133903][T26422] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 295.191856][T26438] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 295.200445][T26438] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 295.235609][T26438] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 295.244070][T26438] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:18 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:18 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:18 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:18 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0x0, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:18 executing program 2: syz_read_part_table(0xe000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:18 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:18 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 295.553368][T26471] loop2: detected capacity change from 0 to 264192 [ 295.595752][T26472] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 295.604225][T26472] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 295.625938][T26471] loop2: p1 p2 p3 p4 [ 295.630209][T26471] loop2: p1 size 78398975 extends beyond EOD, truncated [ 295.638996][T26471] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 295.647594][T26471] loop2: p3 start 2127165541 is beyond EOD, truncated [ 295.654416][T26471] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 295.674748][T26472] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 295.683253][T26472] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:18 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:18 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:18 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0x0, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:18 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:18 executing program 2: syz_read_part_table(0xf000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 295.950617][T26498] loop2: detected capacity change from 0 to 264192 [ 295.997700][T26498] loop2: p1 p2 p3 p4 [ 296.002437][T26498] loop2: p1 size 78398975 extends beyond EOD, truncated [ 296.018452][T26498] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 296.120761][T26510] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 296.129243][T26510] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 296.164853][T26510] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 296.173331][T26510] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 296.211419][T26498] loop2: p3 start 2127165541 is beyond EOD, truncated [ 296.218285][T26498] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:19 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:19 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:19 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:19 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:19 executing program 2: syz_read_part_table(0x10000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:19 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:19 executing program 2: syz_read_part_table(0x11000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 296.549376][T26548] loop2: detected capacity change from 0 to 264192 [ 296.596049][T26548] loop2: p1 p2 p3 p4 [ 296.600144][T26548] loop2: p1 size 78398975 extends beyond EOD, truncated [ 296.628291][T26548] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 296.645402][T26548] loop2: p3 start 2127165541 is beyond EOD, truncated [ 296.652243][T26548] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 296.652919][T26556] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 296.667954][T26556] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:19 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:19 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:19 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:19 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:19 executing program 2: syz_read_part_table(0x12000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 296.739342][T26556] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 296.747814][T26556] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 296.902103][T26572] loop2: detected capacity change from 0 to 264192 [ 296.979029][T26572] loop2: p1 p2 p3 p4 [ 296.997362][T26572] loop2: p1 size 78398975 extends beyond EOD, truncated [ 297.038404][T26588] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 297.046881][T26588] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 297.077117][T26588] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 297.085587][T26588] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 297.108644][T26572] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 297.120785][T26572] loop2: p3 start 2127165541 is beyond EOD, truncated [ 297.128249][T26572] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:20 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:20 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:20 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:20 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:20 executing program 2: syz_read_part_table(0x13000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:20 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:20 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 297.467737][T26604] loop2: detected capacity change from 0 to 264192 [ 297.541245][T26604] loop2: p1 p2 p3 p4 [ 297.545403][T26604] loop2: p1 size 78398975 extends beyond EOD, truncated [ 297.558264][T26604] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 297.594881][T26604] loop2: p3 start 2127165541 is beyond EOD, truncated [ 297.601802][T26604] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:20 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:20 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:20 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x0, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:20 executing program 2: syz_read_part_table(0x20000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:20 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 297.664422][T26626] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 297.672983][T26626] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 297.765122][T26626] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 297.773613][T26626] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 297.822663][T26644] loop2: detected capacity change from 0 to 264192 [ 297.898570][T26644] loop2: p1 p2 p3 p4 [ 297.914399][T26644] loop2: p1 size 78398975 extends beyond EOD, truncated [ 297.938600][T26644] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 297.996601][T26660] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 298.005140][T26660] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 298.034149][T26660] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 298.042651][T26660] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 298.068422][T26644] loop2: p3 start 2127165541 is beyond EOD, truncated [ 298.075234][T26644] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:21 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:21 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\xff\xff\xff', 0x0) 11:02:21 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:21 executing program 2: syz_read_part_table(0x20020000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:21 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x0, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:21 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\xfe\xff\xff', 0x0) 11:02:21 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 298.448422][T26685] loop2: detected capacity change from 0 to 264192 [ 298.491393][T26682] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 298.499969][T26682] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 298.543093][T26682] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 298.552048][T26682] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 298.564168][T26685] loop2: p1 p2 p3 p4 [ 298.569223][T26685] loop2: p1 size 78398975 extends beyond EOD, truncated 11:02:21 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x0, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:21 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x0, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:21 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:21 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:21 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:21 executing program 2: syz_read_part_table(0x25000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 298.609317][T26685] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 298.626444][T26685] loop2: p3 start 2127165541 is beyond EOD, truncated [ 298.633498][T26685] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 298.759665][T26720] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 298.768422][T26720] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 298.796601][T26720] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:21 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 298.805129][T26720] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:22 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x0, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:22 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:22 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x0, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:22 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 299.086418][T26739] loop2: detected capacity change from 0 to 264192 [ 299.116628][T26739] loop2: p1 p2 p3 p4 [ 299.120738][T26739] loop2: p1 size 78398975 extends beyond EOD, truncated [ 299.142378][T26749] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 299.143948][T26739] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 299.151045][T26749] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 299.198313][T26749] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 299.206847][T26749] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:22 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:22 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 299.251437][T26739] loop2: p3 start 2127165541 is beyond EOD, truncated [ 299.258325][T26739] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:22 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) 11:02:22 executing program 2: syz_read_part_table(0x26000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:22 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x0, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:22 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x0, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:22 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:22 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:22 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 299.558368][T26773] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 299.566864][T26773] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 299.587512][T26790] loop2: detected capacity change from 0 to 264192 11:02:22 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 299.692178][T26773] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 299.700656][T26773] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 299.726713][T26790] loop2: p1 p2 p3 p4 [ 299.746252][T26790] loop2: p1 size 78398975 extends beyond EOD, truncated 11:02:22 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:22 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x0, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:22 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) [ 299.813098][T26790] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:02:22 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:22 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 299.884257][T26790] loop2: p3 start 2127165541 is beyond EOD, truncated [ 299.891091][T26790] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:22 executing program 2: syz_read_part_table(0x3e000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:22 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:22 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 299.987168][T26823] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 299.995801][T26823] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 300.054783][T26823] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 300.063307][T26823] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:23 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:23 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) 11:02:23 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:23 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:23 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:23 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:23 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 300.341753][T26856] loop2: detected capacity change from 0 to 264192 [ 300.393207][T26856] loop2: p1 p2 p3 p4 [ 300.404731][T26856] loop2: p1 size 78398975 extends beyond EOD, truncated [ 300.436261][T26856] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 300.444386][T26856] loop2: p3 start 2127165541 is beyond EOD, truncated [ 300.451225][T26856] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:23 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:23 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:23 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:23 executing program 2: syz_read_part_table(0x3f000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:23 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 300.819303][T26826] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 300.827862][T26826] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 300.852924][T26826] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:23 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 300.861569][T26826] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:23 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 300.913084][T26907] loop2: detected capacity change from 0 to 264192 [ 300.966409][T26907] loop2: p1 p2 p3 p4 [ 300.983015][T26907] loop2: p1 size 78398975 extends beyond EOD, truncated 11:02:23 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:23 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 301.020028][T26907] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 301.033287][T26907] loop2: p3 start 2127165541 is beyond EOD, truncated [ 301.040200][T26907] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 301.113851][T26932] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 301.122457][T26932] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 301.165485][T26932] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 301.173987][T26932] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:24 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:24 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:24 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 301.306808][T26907] loop2: detected capacity change from 0 to 264192 [ 301.364530][T26907] loop2: p1 p2 p3 p4 [ 301.368740][T26907] loop2: p1 size 78398975 extends beyond EOD, truncated [ 301.377751][T26907] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 301.386297][T26907] loop2: p3 start 2127165541 is beyond EOD, truncated [ 301.393167][T26907] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 301.469148][T26973] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 301.478047][T26973] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 301.507077][T26973] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 301.515549][T26973] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 301.602816][ T1033] loop2: p1 p2 p3 p4 [ 301.606922][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 301.614310][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 301.622628][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 301.629435][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:24 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:24 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:24 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x0, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:24 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:24 executing program 2: syz_read_part_table(0x40000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:24 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:24 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x0, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:24 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 301.796984][T26998] loop2: detected capacity change from 0 to 264192 [ 301.930888][T27018] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 301.939385][T27018] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 301.974747][T27018] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 301.983241][T27018] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:25 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 302.067271][T26998] loop2: p1 p2 p3 p4 [ 302.072087][T26998] loop2: p1 size 78398975 extends beyond EOD, truncated 11:02:25 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:25 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:25 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 302.144704][T26998] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 302.177572][T26998] loop2: p3 start 2127165541 is beyond EOD, truncated [ 302.184969][T26998] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 302.347887][T27053] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 302.356839][T27053] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 302.384739][T27053] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 302.393234][T27053] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:25 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, 0x0, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:25 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:25 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x0, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:25 executing program 2: syz_read_part_table(0x46020000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:25 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:25 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:25 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 302.645358][T27060] loop2: detected capacity change from 0 to 264192 [ 302.698618][T27060] loop2: p1 p2 p3 p4 [ 302.713019][T27060] loop2: p1 size 78398975 extends beyond EOD, truncated [ 302.743383][T27060] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:02:25 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x0) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:25 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 302.784871][T27082] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 302.793510][T27082] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 302.821638][T27082] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 302.830274][T27082] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 302.873698][T27060] loop2: p3 start 2127165541 is beyond EOD, truncated [ 302.880571][T27060] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:26 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:26 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x02\x00', 0x0) 11:02:26 executing program 2: syz_read_part_table(0x48000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 303.068058][T27109] loop2: detected capacity change from 0 to 264192 [ 303.199536][T27117] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 303.208039][T27117] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 303.235742][T27117] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 303.244213][T27117] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 303.260412][T27109] loop2: p1 p2 p3 p4 [ 303.265956][T27109] loop2: p1 size 78398975 extends beyond EOD, truncated [ 303.284962][T27109] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 303.293723][T27109] loop2: p3 start 2127165541 is beyond EOD, truncated [ 303.300558][T27109] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:26 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, 0x0, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:26 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:26 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x0) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:26 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x03\x00', 0x0) 11:02:26 executing program 2: syz_read_part_table(0x4c000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:26 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x04\x00', 0x0) 11:02:26 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x05\x00', 0x0) [ 303.543051][T27144] loop2: detected capacity change from 0 to 264192 [ 303.659373][T27161] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 303.667954][T27161] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 303.696628][T27161] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:26 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:26 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x06\x00', 0x0) [ 303.705150][T27161] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 303.721785][T27144] loop2: p1 p2 p3 p4 [ 303.726439][T27144] loop2: p1 size 78398975 extends beyond EOD, truncated [ 303.780968][T27144] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:02:26 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:26 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x0) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:26 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\a\x00', 0x0) [ 303.821581][T27144] loop2: p3 start 2127165541 is beyond EOD, truncated [ 303.828414][T27144] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 304.057813][T27193] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 304.066387][T27193] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 304.094671][T27193] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 304.103151][T27193] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:27 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, 0x0, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:27 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:27 executing program 2: syz_read_part_table(0x60000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:27 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\b\x00', 0x0) 11:02:27 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r2 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) 11:02:27 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\t\x00', 0x0) 11:02:27 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r2 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) 11:02:27 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:27 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\n\x00', 0x0) [ 304.421993][T27205] loop2: detected capacity change from 0 to 264192 [ 304.547893][T27228] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 304.556436][T27228] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 304.584431][T27228] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 304.592917][T27228] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 304.609139][T27205] loop2: p1 p2 p3 p4 [ 304.619525][T27205] loop2: p1 size 78398975 extends beyond EOD, truncated [ 304.657864][T27205] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 304.666671][T27205] loop2: p3 start 2127165541 is beyond EOD, truncated [ 304.673503][T27205] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:27 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:27 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r2 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) 11:02:27 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 304.931788][T27255] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 304.940297][T27255] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 304.968207][T27255] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 304.976671][T27255] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:28 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:28 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\v\x00', 0x0) 11:02:28 executing program 2: syz_read_part_table(0x68000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:28 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, 0x0, 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:28 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:28 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\f\x00', 0x0) 11:02:28 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 305.272460][T27261] loop2: detected capacity change from 0 to 264192 [ 305.299735][T27261] loop2: p1 p2 p3 p4 [ 305.303965][T27261] loop2: p1 size 78398975 extends beyond EOD, truncated [ 305.330601][T27261] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 305.346666][T27261] loop2: p3 start 2127165541 is beyond EOD, truncated [ 305.353543][T27261] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:28 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, 0x0, 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 305.441759][T27284] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 305.450243][T27284] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 305.478501][T27284] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:28 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 305.487034][T27284] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:28 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:28 executing program 2: syz_read_part_table(0x6c000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:28 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\r\x00', 0x0) [ 305.656671][T27303] loop2: detected capacity change from 0 to 264192 [ 305.697955][T27303] loop2: p1 p2 p3 p4 [ 305.702103][T27303] loop2: p1 size 78398975 extends beyond EOD, truncated [ 305.710494][T27303] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 305.722917][T27303] loop2: p3 start 2127165541 is beyond EOD, truncated [ 305.729857][T27303] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 305.762887][T27313] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 305.771749][T27313] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 305.797606][T27313] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 305.806268][T27313] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 305.821805][ T1033] loop2: p1 p2 p3 p4 [ 305.825960][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 305.833345][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 305.840870][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 305.847684][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:29 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:29 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, 0x0, 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:02:29 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:29 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x0e\x00', 0x0) 11:02:29 executing program 2: syz_read_part_table(0x74000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:29 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x0f\x00', 0x0) 11:02:29 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:29 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r3, 0x0) [ 306.179266][T27337] loop2: detected capacity change from 0 to 264192 [ 306.243582][T27337] loop2: p1 p2 p3 p4 [ 306.248392][T27337] loop2: p1 size 78398975 extends beyond EOD, truncated [ 306.282691][T27337] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 306.297140][T27337] loop2: p3 start 2127165541 is beyond EOD, truncated [ 306.304007][T27337] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 306.347228][T27359] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 306.355705][T27359] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 306.384726][T27359] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 306.393364][T27359] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:29 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:29 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:29 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x10\x00', 0x0) 11:02:29 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r3, 0x0) [ 306.617092][T27380] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 306.625617][T27380] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 306.661699][T27380] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 306.670218][T27380] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:30 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:30 executing program 2: syz_read_part_table(0x779e53b9, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:30 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:30 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r3, 0x0) 11:02:30 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x11\x00', 0x0) 11:02:30 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x12\x00', 0x0) 11:02:30 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 307.130423][T27403] loop2: detected capacity change from 0 to 264192 [ 307.221140][T27409] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 307.229722][T27409] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 307.258093][T27409] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:30 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r3, 0x0) [ 307.266541][T27409] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:30 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:30 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:30 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00H\x00', 0x0) [ 307.405937][T27403] loop2: p1 p2 p3 p4 [ 307.418293][T27403] loop2: p1 size 78398975 extends beyond EOD, truncated 11:02:30 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 307.472321][T27424] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 307.480934][T27424] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 307.489072][T27403] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 307.504683][T27403] loop2: p3 start 2127165541 is beyond EOD, truncated [ 307.512093][T27403] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 307.532449][T27424] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 307.541001][T27424] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:30 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:30 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00L\x00', 0x0) 11:02:30 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r3, 0x0) 11:02:30 executing program 2: syz_read_part_table(0x7a000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:30 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:30 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r3, 0x0) 11:02:30 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00h\x00', 0x0) 11:02:30 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 307.958227][T27449] loop2: detected capacity change from 0 to 264192 [ 308.039280][T27449] loop2: p1 p2 p3 p4 [ 308.044303][T27449] loop2: p1 size 78398975 extends beyond EOD, truncated [ 308.120072][T27469] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 308.128579][T27469] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 308.157820][T27469] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:31 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:31 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) [ 308.166493][T27469] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 308.199538][T27449] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:02:31 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00l\x00', 0x0) [ 308.230332][T27449] loop2: p3 start 2127165541 is beyond EOD, truncated [ 308.237184][T27449] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:31 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00t\x00', 0x0) [ 308.401657][T27496] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 308.410147][T27496] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 308.437902][T27496] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 308.446395][T27496] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:31 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:31 executing program 2: syz_read_part_table(0x80040000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:31 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:31 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00z\x00', 0x0) 11:02:31 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) 11:02:31 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x03', 0x0) 11:02:31 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 308.853159][T27517] loop2: detected capacity change from 0 to 264192 [ 308.986751][T27531] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 308.995644][T27531] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 309.025162][T27531] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:32 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) [ 309.033652][T27531] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 309.052475][T27517] loop2: p1 p2 p3 p4 [ 309.062344][T27517] loop2: p1 size 78398975 extends beyond EOD, truncated 11:02:32 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:32 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:32 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x05', 0x0) [ 309.100675][T27517] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:02:32 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x06', 0x0) [ 309.151819][T27517] loop2: p3 start 2127165541 is beyond EOD, truncated [ 309.158726][T27517] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 309.246981][T27517] loop2: detected capacity change from 0 to 264192 [ 309.289447][T27569] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 309.298124][T27569] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 309.331754][T27569] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 309.340642][T27569] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:32 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:32 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:32 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\a', 0x0) 11:02:32 executing program 2: syz_read_part_table(0x80ffffff, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:32 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) 11:02:32 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\t', 0x0) 11:02:32 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 309.689548][T27578] loop2: detected capacity change from 0 to 264192 11:02:32 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\n', 0x0) [ 309.731919][T27578] loop2: p1 p2 p3 p4 [ 309.739172][T27578] loop2: p1 size 78398975 extends beyond EOD, truncated [ 309.776780][T27578] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 309.829851][T27578] loop2: p3 start 2127165541 is beyond EOD, truncated [ 309.836687][T27578] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 309.894745][T27605] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 309.903206][T27605] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 309.932697][T27605] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:33 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:33 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:33 executing program 2: syz_read_part_table(0x8cffffff, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:33 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) [ 309.941266][T27605] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 310.122527][T27625] loop2: detected capacity change from 0 to 264192 [ 310.166657][T27629] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 310.175266][T27629] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 310.211171][T27629] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 310.220124][T27629] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 310.258165][T27625] loop2: p1 p2 p3 p4 [ 310.262678][T27625] loop2: p1 size 78398975 extends beyond EOD, truncated [ 310.270665][T27625] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 310.278313][T27625] loop2: p3 start 2127165541 is beyond EOD, truncated [ 310.285242][T27625] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:33 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) 11:02:33 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\v', 0x0) 11:02:33 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:33 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:33 executing program 2: syz_read_part_table(0x97ffffff, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:33 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\f', 0x0) 11:02:33 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:33 executing program 3: syz_read_part_table(0x7a000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 310.641883][T27656] loop2: detected capacity change from 0 to 264192 [ 310.700014][T27656] loop2: p1 p2 p3 p4 [ 310.714731][T27656] loop2: p1 size 78398975 extends beyond EOD, truncated [ 310.751252][T27656] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 310.776827][T27656] loop2: p3 start 2127165541 is beyond EOD, truncated [ 310.783752][T27656] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 310.804575][T27677] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 310.813230][T27677] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:33 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:33 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\r', 0x0) 11:02:33 executing program 3: syz_read_part_table(0x7a000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:33 executing program 2: syz_read_part_table(0xb20f0000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:33 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:33 executing program 3: syz_read_part_table(0x7a000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 310.867435][T27677] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 310.876030][T27677] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:33 executing program 3: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\f', 0x0) [ 311.093990][T27716] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 311.103075][T27716] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 311.131926][T27716] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 311.140623][T27716] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:34 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:34 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x0e', 0x0) 11:02:34 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:34 executing program 2: syz_read_part_table(0xb30f0000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:34 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 311.534612][T27735] loop2: detected capacity change from 0 to 264192 [ 311.659441][T27744] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 311.668078][T27744] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 311.697360][T27744] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 311.705829][T27744] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 311.719000][T27735] loop2: p1 p2 p3 p4 [ 311.723847][T27735] loop2: p1 size 78398975 extends beyond EOD, truncated [ 311.750635][T27735] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 311.788244][T27735] loop2: p3 start 2127165541 is beyond EOD, truncated 11:02:34 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:34 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x0f', 0x0) 11:02:34 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:34 executing program 2: syz_read_part_table(0xb40f0000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 311.795197][T27735] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 311.871139][T27745] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 311.879631][T27745] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:35 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x11', 0x0) [ 311.963373][T27745] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 311.971920][T27745] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:35 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 312.022368][T27766] loop2: detected capacity change from 0 to 264192 [ 312.074703][T27766] loop2: p1 p2 p3 p4 [ 312.078893][T27766] loop2: p1 size 78398975 extends beyond EOD, truncated [ 312.091849][T27766] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 312.101814][T27770] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 312.110334][T27770] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 312.120227][T27766] loop2: p3 start 2127165541 is beyond EOD, truncated [ 312.128391][T27766] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 312.155427][T27770] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 312.163923][T27770] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:35 executing program 2: syz_read_part_table(0xb5020000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 312.336747][T27791] loop2: detected capacity change from 0 to 264192 [ 312.359856][T27791] loop2: p1 p2 p3 p4 [ 312.365860][T27791] loop2: p1 size 78398975 extends beyond EOD, truncated [ 312.374544][T27791] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:02:35 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x12', 0x0) 11:02:35 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:35 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:35 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:35 executing program 2: syz_read_part_table(0xb50f0000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 312.382709][T27791] loop2: p3 start 2127165541 is beyond EOD, truncated [ 312.389558][T27791] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 312.540331][T27820] loop2: detected capacity change from 0 to 264192 [ 312.575404][T27820] loop2: p1 p2 p3 p4 [ 312.579832][T27820] loop2: p1 size 78398975 extends beyond EOD, truncated [ 312.596251][T27820] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 312.630940][T27820] loop2: p3 start 2127165541 is beyond EOD, truncated [ 312.637756][T27820] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:35 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00H', 0x0) 11:02:35 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:35 executing program 2: syz_read_part_table(0xb60f0000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:35 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 312.756580][T27833] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 312.765219][T27833] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:35 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00L', 0x0) [ 312.976782][T27833] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 312.985547][T27833] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 313.023430][T27847] loop2: detected capacity change from 0 to 264192 11:02:36 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:36 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00h', 0x0) [ 313.120146][T27847] loop2: p1 p2 p3 p4 [ 313.126868][T27847] loop2: p1 size 78398975 extends beyond EOD, truncated [ 313.152313][T27847] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 313.211075][T27847] loop2: p3 start 2127165541 is beyond EOD, truncated [ 313.217946][T27847] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:36 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00l', 0x0) 11:02:36 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:36 executing program 2: syz_read_part_table(0xb9539e77, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 313.450183][T27816] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 313.458939][T27816] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:36 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:36 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:36 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00t', 0x0) [ 313.503988][T27816] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 313.512586][T27816] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:36 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:36 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00z', 0x0) [ 313.584135][T27894] loop2: detected capacity change from 0 to 264192 [ 313.652341][T27894] loop2: p1 p2 p3 p4 [ 313.656592][T27894] loop2: p1 size 78398975 extends beyond EOD, truncated [ 313.686372][T27894] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 313.727212][T27894] loop2: p3 start 2127165541 is beyond EOD, truncated [ 313.734835][T27894] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:36 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:36 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:36 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:36 executing program 2: syz_read_part_table(0xc9ffffff, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 313.938644][T27920] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 313.947181][T27920] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:37 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 314.114719][T27920] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 314.123224][T27920] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 314.165023][T27941] loop2: detected capacity change from 0 to 264192 11:02:37 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:37 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 314.230289][T27941] loop2: p1 p2 p3 p4 [ 314.234391][T27941] loop2: p1 size 78398975 extends beyond EOD, truncated [ 314.238752][T27953] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 314.249772][T27953] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 314.277685][T27953] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 314.286195][T27953] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 314.292951][T27941] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 314.372165][T27941] loop2: p3 start 2127165541 is beyond EOD, truncated [ 314.379007][T27941] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:37 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:37 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:37 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:37 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:37 executing program 2: syz_read_part_table(0xd4010000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 314.486147][T27941] loop2: detected capacity change from 0 to 264192 11:02:37 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:37 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 314.689674][T28004] loop2: detected capacity change from 0 to 264192 [ 314.805226][T28004] loop2: p1 p2 p3 p4 [ 314.809920][T28004] loop2: p1 size 78398975 extends beyond EOD, truncated [ 314.833601][T28004] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 314.856263][T28004] loop2: p3 start 2127165541 is beyond EOD, truncated [ 314.863722][T28004] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:37 executing program 2: syz_read_part_table(0xd5260000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:37 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:37 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:37 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 314.934789][T28004] loop2: detected capacity change from 0 to 264192 11:02:38 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 315.128134][T28040] loop2: detected capacity change from 0 to 264192 [ 315.181242][T28040] loop2: p1 p2 p3 p4 [ 315.185689][T28040] loop2: p1 size 78398975 extends beyond EOD, truncated [ 315.204487][T28040] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 315.229005][T28040] loop2: p3 start 2127165541 is beyond EOD, truncated [ 315.235928][T28040] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:38 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:38 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:38 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 315.536207][T27979] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 315.545069][T27979] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:38 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:38 executing program 2: syz_read_part_table(0xf5040000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:38 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:38 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 315.590148][T27979] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 315.598715][T27979] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:38 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 315.669742][T28076] loop2: detected capacity change from 0 to 264192 [ 315.721884][T28076] loop2: p1 p2 p3 p4 [ 315.730300][T28076] loop2: p1 size 78398975 extends beyond EOD, truncated [ 315.774068][T28083] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 315.783205][T28083] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 315.794049][T28076] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 315.817265][T28076] loop2: p3 start 2127165541 is beyond EOD, truncated 11:02:38 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:38 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:38 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:38 executing program 2: syz_read_part_table(0xf6ffffff, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 315.821174][T28083] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 315.824148][T28076] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 315.832552][T28083] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 315.998029][T28110] loop2: detected capacity change from 0 to 264192 [ 316.051056][T28110] loop2: p1 p2 p3 p4 [ 316.055682][T28110] loop2: p1 size 78398975 extends beyond EOD, truncated [ 316.070649][T28110] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 316.088393][T28110] loop2: p3 start 2127165541 is beyond EOD, truncated [ 316.095243][T28110] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:39 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x0, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:39 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:39 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 316.559653][T28070] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 316.568311][T28070] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:39 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:39 executing program 2: syz_read_part_table(0xfdfdffff, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:39 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:39 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 316.614914][T28070] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 316.623634][T28070] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:39 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 316.702709][T28142] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 316.711243][T28142] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:39 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 316.747895][T28142] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 316.756418][T28142] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:39 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 316.807100][T28157] loop2: detected capacity change from 0 to 264192 11:02:39 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 316.894183][T28157] loop2: p1 p2 p3 p4 [ 316.898518][T28157] loop2: p1 size 78398975 extends beyond EOD, truncated [ 316.916724][T28157] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 316.934976][T28157] loop2: p3 start 2127165541 is beyond EOD, truncated [ 316.941845][T28157] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:39 executing program 2: syz_read_part_table(0xfdffffff, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 317.074172][T28167] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 317.082743][T28167] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 317.120946][T28167] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 317.129490][T28167] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 317.174618][T28183] loop2: detected capacity change from 0 to 264192 [ 317.251455][T28183] loop2: p1 p2 p3 p4 [ 317.256370][T28183] loop2: p1 size 78398975 extends beyond EOD, truncated [ 317.268141][T28183] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 317.303709][T28183] loop2: p3 start 2127165541 is beyond EOD, truncated [ 317.310553][T28183] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:40 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x0, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:40 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:40 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:40 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:40 executing program 2: syz_read_part_table(0xfeffffff, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:40 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:40 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:40 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 317.741046][T28225] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 317.749546][T28225] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:40 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 317.838499][T28225] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 317.847112][T28225] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 317.881749][T28233] loop2: detected capacity change from 0 to 264192 11:02:40 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 317.961556][T28233] loop2: p1 p2 p3 p4 [ 317.966144][T28233] loop2: p1 size 78398975 extends beyond EOD, truncated [ 317.978372][T28233] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 317.988426][T28233] loop2: p3 start 2127165541 is beyond EOD, truncated [ 317.995291][T28233] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:41 executing program 2: syz_read_part_table(0xff0f0000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 318.049586][T28237] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 318.058086][T28237] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 318.086765][T28237] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:41 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 318.095287][T28237] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 318.211114][T28264] loop2: detected capacity change from 0 to 264192 [ 318.296008][T28264] loop2: p1 p2 p3 p4 [ 318.300601][T28264] loop2: p1 size 78398975 extends beyond EOD, truncated [ 318.342165][T28264] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 318.369802][T28264] loop2: p3 start 2127165541 is beyond EOD, truncated [ 318.376667][T28264] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:41 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x0, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:41 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:41 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 318.748339][T28304] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 318.756841][T28304] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:41 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:41 executing program 2: syz_read_part_table(0xffefffff, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:41 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:41 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:41 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 318.800083][T28304] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 318.808771][T28304] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:41 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:41 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 318.923244][T28316] loop2: detected capacity change from 0 to 264192 [ 318.975104][T28316] loop2: p1 p2 p3 p4 [ 318.979379][T28316] loop2: p1 size 78398975 extends beyond EOD, truncated [ 318.987297][T28316] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 319.016427][T28316] loop2: p3 start 2127165541 is beyond EOD, truncated [ 319.023294][T28316] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 319.044456][T28313] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 319.052950][T28313] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:42 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:42 executing program 2: syz_read_part_table(0xffffe000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 319.082372][T28313] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 319.090817][T28313] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 319.242327][T28343] loop2: detected capacity change from 0 to 264192 [ 319.283263][T28343] loop2: p1 p2 p3 p4 [ 319.292198][T28343] loop2: p1 size 78398975 extends beyond EOD, truncated [ 319.317648][T28343] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 319.345378][T28343] loop2: p3 start 2127165541 is beyond EOD, truncated [ 319.352293][T28343] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:42 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:42 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:42 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 319.748133][T28383] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 319.756711][T28383] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:42 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\xff\xff', 0x0) 11:02:42 executing program 2: syz_read_part_table(0xffffefff, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:42 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:42 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:42 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 319.807406][T28383] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 319.815881][T28383] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:42 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\xfe\xff', 0x0) 11:02:42 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 319.919329][T28392] loop2: detected capacity change from 0 to 264192 [ 319.972180][T28392] loop2: p1 p2 p3 p4 [ 319.976246][T28392] loop2: p1 size 78398975 extends beyond EOD, truncated [ 319.988756][T28392] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:02:43 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 320.029737][T28392] loop2: p3 start 2127165541 is beyond EOD, truncated [ 320.036697][T28392] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:43 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:43 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:43 executing program 2: syz_read_part_table(0xfffffdfd, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:43 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:43 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:43 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:43 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 320.474419][T28445] loop2: detected capacity change from 0 to 264192 [ 320.508893][T28445] loop2: p1 p2 p3 p4 [ 320.517264][T28445] loop2: p1 size 78398975 extends beyond EOD, truncated [ 320.544576][T28445] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 320.554139][T28445] loop2: p3 start 2127165541 is beyond EOD, truncated [ 320.561057][T28445] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:43 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 320.790246][T28388] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 320.799026][T28388] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:43 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:43 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:43 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:43 executing program 2: syz_read_part_table(0xffffff7f, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 320.919360][T28388] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 320.928160][T28388] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:44 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 321.066482][T28492] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 321.075860][T28492] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:44 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:44 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:44 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 321.159497][T28500] loop2: detected capacity change from 0 to 264192 [ 321.184866][T28492] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 321.193559][T28492] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:44 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 321.269155][T28500] loop2: p1 p2 p3 p4 [ 321.283598][T28500] loop2: p1 size 78398975 extends beyond EOD, truncated 11:02:44 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 321.315958][T28500] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 321.332290][T28512] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 321.340830][T28512] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 321.358201][T28500] loop2: p3 start 2127165541 is beyond EOD, truncated 11:02:44 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 321.365218][T28500] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 321.412116][T28512] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 321.420627][T28512] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 321.447305][T28500] loop2: detected capacity change from 0 to 264192 [ 321.510909][T28500] loop2: p1 p2 p3 p4 [ 321.515163][T28500] loop2: p1 size 78398975 extends beyond EOD, truncated [ 321.556034][T28500] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 321.576394][T28500] loop2: p3 start 2127165541 is beyond EOD, truncated [ 321.583381][T28500] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 321.684836][T28550] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 321.693363][T28550] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:44 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:44 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:44 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:44 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:44 executing program 2: syz_read_part_table(0xffffff80, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 321.730124][T28550] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 321.738738][T28550] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:44 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 321.839323][T28564] loop2: detected capacity change from 0 to 264192 [ 321.861741][T28558] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 321.871459][T28558] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:44 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 321.958535][T28564] loop2: p1 p2 p3 p4 11:02:45 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 322.021159][T28564] loop2: p1 size 78398975 extends beyond EOD, truncated [ 322.034625][T28558] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 322.043128][T28558] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 322.089616][T28564] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 322.127219][T28564] loop2: p3 start 2127165541 is beyond EOD, truncated 11:02:45 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 322.134163][T28564] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:45 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:45 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:45 executing program 2: syz_read_part_table(0xffffff8c, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 322.410519][T28613] loop2: detected capacity change from 0 to 264192 [ 322.444889][T28613] loop2: p1 p2 p3 p4 [ 322.452211][T28613] loop2: p1 size 78398975 extends beyond EOD, truncated [ 322.470912][T28613] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 322.479345][T28613] loop2: p3 start 2127165541 is beyond EOD, truncated [ 322.486523][T28613] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:45 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:45 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:45 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:45 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:45 executing program 2: syz_read_part_table(0xffffff97, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:45 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:45 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 322.702236][T28648] loop2: detected capacity change from 0 to 264192 [ 322.744171][T28648] loop2: p1 p2 p3 p4 [ 322.749326][T28648] loop2: p1 size 78398975 extends beyond EOD, truncated 11:02:45 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 322.817119][T28648] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 322.912067][T28648] loop2: p3 start 2127165541 is beyond EOD, truncated [ 322.918971][T28648] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:46 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:46 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:46 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:46 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) [ 323.121695][T28588] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 323.130827][T28588] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 323.175618][T28588] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 323.184751][T28588] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 323.274824][T28702] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 323.283522][T28702] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 323.318964][T28702] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 323.327670][T28702] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:46 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:46 executing program 2: syz_read_part_table(0xffffffc9, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:46 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:46 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:46 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) 11:02:46 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:46 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) 11:02:46 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 323.581447][T28719] loop2: detected capacity change from 0 to 264192 [ 323.743974][T28719] loop2: p1 p2 p3 p4 [ 323.764157][T28719] loop2: p1 size 78398975 extends beyond EOD, truncated [ 323.843423][T28719] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 323.880482][T28719] loop2: p3 start 2127165541 is beyond EOD, truncated [ 323.887442][T28719] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:47 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:47 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:47 executing program 2: syz_read_part_table(0xfffffff6, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:47 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 324.096496][T28696] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 324.104999][T28696] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 324.131641][T28696] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 324.140215][T28696] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 324.199019][T28762] loop2: detected capacity change from 0 to 264192 [ 324.283614][T28762] loop2: p1 p2 p3 p4 [ 324.288007][T28762] loop2: p1 size 78398975 extends beyond EOD, truncated 11:02:47 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:47 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:47 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 324.346739][T28762] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 324.359945][T28762] loop2: p3 start 2127165541 is beyond EOD, truncated [ 324.367067][T28762] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:47 executing program 2: syz_read_part_table(0xfffffffd, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:47 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:47 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:47 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:47 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 324.652871][T28811] loop2: detected capacity change from 0 to 264192 [ 324.813996][T28811] loop2: p1 p2 p3 p4 [ 324.818233][T28811] loop2: p1 size 78398975 extends beyond EOD, truncated [ 324.827986][T28811] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 324.836033][T28811] loop2: p3 start 2127165541 is beyond EOD, truncated [ 324.843665][T28811] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:47 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:47 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:47 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 325.059373][T28761] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 325.068008][T28761] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:48 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 325.110780][T28761] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 325.119388][T28761] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:48 executing program 2: syz_read_part_table(0xfffffffe, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:48 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:48 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x02', 0x0) 11:02:48 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 325.249183][T28840] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 325.258178][T28840] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:48 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 325.290612][T28840] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 325.299127][T28840] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:48 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x03', 0x0) 11:02:48 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:48 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x04', 0x0) [ 325.435353][T28853] loop2: detected capacity change from 0 to 264192 [ 325.724359][T28853] loop2: p1 p2 p3 p4 [ 325.730065][T28853] loop2: p1 size 78398975 extends beyond EOD, truncated [ 325.738334][T28853] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 325.746483][T28853] loop2: p3 start 2127165541 is beyond EOD, truncated [ 325.753295][T28853] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:49 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x0, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:49 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:49 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x05', 0x0) 11:02:49 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 325.976056][T28830] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 325.984519][T28830] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 326.010234][T28830] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 326.019840][T28830] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:49 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:49 executing program 2: syz_read_part_table(0x80000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:49 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x06', 0x0) 11:02:49 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x0, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:49 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\a', 0x0) 11:02:49 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\b', 0x0) [ 326.385986][T28927] loop2: detected capacity change from 0 to 264192 11:02:49 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\t', 0x0) 11:02:49 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\n', 0x0) 11:02:49 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x0, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 326.596796][T28927] loop2: p1 p2 p3 p4 [ 326.612239][T28927] loop2: p1 size 78398975 extends beyond EOD, truncated [ 326.632022][T28927] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 326.641298][T28927] loop2: p3 start 2127165541 is beyond EOD, truncated [ 326.648148][T28927] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:49 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:49 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\v', 0x0) 11:02:49 executing program 2: syz_read_part_table(0x100000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 326.938138][T28899] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 326.946945][T28899] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 326.983328][T28899] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 326.991816][T28899] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 327.046802][T28975] loop2: detected capacity change from 0 to 264192 11:02:50 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:50 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:50 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:50 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\f', 0x0) 11:02:50 executing program 2: syz_read_part_table(0x1000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:50 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\r', 0x0) [ 327.094548][T28975] loop2: p1 p2 p3 p4 [ 327.098722][T28975] loop2: p1 size 78398975 extends beyond EOD, truncated [ 327.107190][T28975] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 327.121740][T28975] loop2: p3 start 2127165541 is beyond EOD, truncated [ 327.128614][T28975] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:50 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:50 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x0e', 0x0) 11:02:50 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x0f', 0x0) [ 327.630504][T29004] loop2: detected capacity change from 0 to 264192 [ 327.712961][T29004] loop2: p1 p2 p3 p4 [ 327.719559][T29004] loop2: p1 size 78398975 extends beyond EOD, truncated [ 327.730999][T29004] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 327.751002][T29004] loop2: p3 start 2127165541 is beyond EOD, truncated [ 327.757861][T29004] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:50 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x10', 0x0) 11:02:50 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:50 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 327.919146][T28971] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 327.927807][T28971] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 327.955435][T28971] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:50 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:50 executing program 2: syz_read_part_table(0x2000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:50 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 327.963882][T28971] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:51 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x11', 0x0) 11:02:51 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 328.070611][T29069] loop2: detected capacity change from 0 to 264192 [ 328.107416][T29069] loop2: p1 p2 p3 p4 [ 328.111712][T29069] loop2: p1 size 78398975 extends beyond EOD, truncated [ 328.120114][T29069] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 328.128076][T29069] loop2: p3 start 2127165541 is beyond EOD, truncated [ 328.134909][T29069] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:51 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x12', 0x0) 11:02:51 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00H', 0x0) 11:02:51 executing program 2: syz_read_part_table(0x4000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:51 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 328.656541][T29113] loop2: detected capacity change from 0 to 264192 [ 328.705350][T29113] loop2: p1 p2 p3 p4 [ 328.709961][T29113] loop2: p1 size 78398975 extends beyond EOD, truncated [ 328.724899][T29113] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 328.733624][T29113] loop2: p3 start 2127165541 is beyond EOD, truncated [ 328.740537][T29113] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:51 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:51 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00L', 0x0) 11:02:51 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:51 executing program 2: syz_read_part_table(0x7ffffffffffff, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:51 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:51 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 328.915740][T29056] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 328.924254][T29056] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:52 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00h', 0x0) [ 328.973328][T29056] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 328.981905][T29056] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 329.069667][T29142] loop2: detected capacity change from 0 to 264192 11:02:52 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x0, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:52 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00l', 0x0) 11:02:52 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x0, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:52 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00t', 0x0) [ 329.486398][T29142] loop2: p1 p2 p3 p4 [ 329.496839][T29142] loop2: p1 size 78398975 extends beyond EOD, truncated [ 329.510222][T29142] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 329.519288][T29142] loop2: p3 start 2127165541 is beyond EOD, truncated 11:02:52 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00z', 0x0) [ 329.527034][T29142] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 329.571292][T29142] loop2: detected capacity change from 0 to 264192 [ 329.618642][T29142] loop2: p1 p2 p3 p4 [ 329.629324][T29142] loop2: p1 size 78398975 extends beyond EOD, truncated [ 329.643064][T29142] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 329.657049][T29142] loop2: p3 start 2127165541 is beyond EOD, truncated [ 329.663997][T29142] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 329.766827][ T1787] __loop_clr_fd: partition scan of loop2 failed (rc=-16) [ 329.767446][T29138] print_req_error: 17 callbacks suppressed [ 329.767458][T29138] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 329.776056][T29199] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 329.781394][ T616] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 329.791989][T29150] blk_update_request: I/O error, dev loop2, sector 263946 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 329.803447][ T616] buffer_io_error: 8 callbacks suppressed [ 329.803462][ T616] Buffer I/O error on dev loop2p2, logical block 33008, async page read [ 329.840756][ T616] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 329.852222][ T616] Buffer I/O error on dev loop2p4, logical block 33008, async page read [ 329.860673][ T616] blk_update_request: I/O error, dev loop2, sector 263946 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 329.872005][ T616] Buffer I/O error on dev loop2p1, logical block 131968, async page read [ 329.881109][ T616] blk_update_request: I/O error, dev loop2, sector 263948 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 329.892765][ T616] Buffer I/O error on dev loop2p1, logical block 131969, async page read [ 329.901257][ T616] blk_update_request: I/O error, dev loop2, sector 263950 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 329.912586][ T616] Buffer I/O error on dev loop2p1, logical block 131970, async page read [ 329.921596][ T616] blk_update_request: I/O error, dev loop2, sector 263952 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 329.932933][ T616] Buffer I/O error on dev loop2p1, logical block 131971, async page read [ 329.970768][T29199] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 329.978989][T29137] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 329.984182][ T853] Buffer I/O error on dev loop2p4, logical block 33008, async page read [ 329.991431][T29137] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 330.004500][ T853] Buffer I/O error on dev loop2p1, logical block 131968, async page read 11:02:53 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:53 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x0, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:53 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:53 executing program 2: syz_read_part_table(0x20000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:53 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:53 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:53 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 330.020569][ T853] Buffer I/O error on dev loop2p1, logical block 131969, async page read [ 330.029129][T29137] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 330.030251][ T853] Buffer I/O error on dev loop2p1, logical block 131970, async page read [ 330.038898][T29137] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:53 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:53 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x0) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:53 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 330.120830][T29212] loop2: detected capacity change from 0 to 264192 11:02:53 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 330.167365][T29212] loop2: p1 p2 p3 p4 [ 330.171513][T29212] loop2: p1 size 78398975 extends beyond EOD, truncated [ 330.187542][T29212] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 330.195149][T29212] loop2: p3 start 2127165541 is beyond EOD, truncated [ 330.201991][T29212] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:53 executing program 2: syz_read_part_table(0x90000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 330.502187][T29264] loop2: detected capacity change from 0 to 264192 [ 330.535789][T29264] loop2: p1 p2 p3 p4 [ 330.540059][T29264] loop2: p1 size 78398975 extends beyond EOD, truncated [ 330.548551][T29264] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 330.556935][T29264] loop2: p3 start 2127165541 is beyond EOD, truncated [ 330.563801][T29264] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:54 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:54 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x0) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:54 executing program 2: syz_read_part_table(0xe0ffff00000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:54 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:54 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 330.982568][T29218] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 330.991232][T29218] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 331.034233][T29218] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 331.042692][T29218] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 331.106637][T29299] loop2: detected capacity change from 0 to 264192 11:02:54 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 331.410446][T29299] loop2: p1 p2 p3 p4 [ 331.416793][T29299] loop2: p1 size 78398975 extends beyond EOD, truncated [ 331.445154][T29299] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 331.453320][T29299] loop2: p3 start 2127165541 is beyond EOD, truncated [ 331.460241][T29299] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 331.495262][T29299] loop2: detected capacity change from 0 to 264192 [ 331.556354][T29299] loop2: p1 p2 p3 p4 [ 331.560938][T29299] loop2: p1 size 78398975 extends beyond EOD, truncated [ 331.569372][T29299] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 331.578000][T29299] loop2: p3 start 2127165541 is beyond EOD, truncated [ 331.584807][T29299] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:54 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:54 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:54 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:54 executing program 2: syz_read_part_table(0x100000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:54 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:54 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 331.959926][T29288] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 331.968385][T29288] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 331.994475][T29288] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:55 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:02:55 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 332.003042][T29288] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:55 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x0) preadv(r1, 0x0, 0x0, 0x0, 0x0) 11:02:55 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 332.062518][T29375] loop2: detected capacity change from 0 to 264192 [ 332.151019][T29394] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 332.159560][T29394] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 332.202282][T29394] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 332.210781][T29394] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 332.236259][T29375] loop2: p1 p2 p3 p4 11:02:55 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x0) preadv(r1, 0x0, 0x0, 0x0, 0x0) 11:02:55 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 332.277689][T29375] loop2: p1 size 78398975 extends beyond EOD, truncated [ 332.299086][T29375] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 332.309753][T29375] loop2: p3 start 2127165541 is beyond EOD, truncated [ 332.316972][T29375] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 332.396221][T29375] loop2: detected capacity change from 0 to 264192 [ 332.417632][T29375] loop2: p1 p2 p3 p4 [ 332.421931][T29375] loop2: p1 size 78398975 extends beyond EOD, truncated [ 332.430705][T29375] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 332.438813][T29375] loop2: p3 start 2127165541 is beyond EOD, truncated [ 332.445775][T29375] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:55 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:55 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0xf93, 0x0, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x0) preadv(r1, 0x0, 0x0, 0x0, 0x0) 11:02:55 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:55 executing program 2: syz_read_part_table(0x200000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:55 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:55 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 332.920926][T29370] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 332.929797][T29370] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 332.957013][T29370] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:55 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:56 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:56 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:02:56 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 332.965782][T29370] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 333.035431][T29451] loop2: detected capacity change from 0 to 264192 [ 333.146378][T29468] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 333.155045][T29468] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 333.193044][T29468] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 333.201805][T29468] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:56 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:56 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 333.313239][T29451] loop2: p1 p2 p3 p4 [ 333.318676][T29451] loop2: p1 size 78398975 extends beyond EOD, truncated [ 333.327209][T29451] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 333.341452][T29451] loop2: p3 start 2127165541 is beyond EOD, truncated [ 333.348365][T29451] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:56 executing program 3: sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:56 executing program 2: syz_read_part_table(0x204000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:56 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:56 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r3) 11:02:56 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 333.886074][T29437] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 333.894813][T29437] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 333.922207][T29437] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:56 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 333.931090][T29437] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 333.976358][T29513] loop2: detected capacity change from 0 to 264192 [ 334.029797][T29518] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 334.038268][T29518] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 334.065818][T29513] loop2: p1 p2 p3 p4 11:02:57 executing program 1: syz_read_part_table(0x100000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 334.077365][T29518] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 334.085830][T29518] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:57 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 334.129341][T29513] loop2: p1 size 78398975 extends beyond EOD, truncated [ 334.155309][T29513] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 334.194972][T29513] loop2: p3 start 2127165541 is beyond EOD, truncated [ 334.201856][T29513] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:57 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:57 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 334.277743][T29535] loop1: detected capacity change from 0 to 264192 11:02:57 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:57 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 334.388998][T29535] loop1: p1 p2 p3 p4 [ 334.394200][T29513] loop2: detected capacity change from 0 to 264192 [ 334.403853][T29535] loop1: p1 size 78398975 extends beyond EOD, truncated [ 334.411501][T29535] loop1: p2 size 1073872896 extends beyond EOD, truncated [ 334.419650][T29535] loop1: p3 start 2127165541 is beyond EOD, truncated [ 334.426584][T29535] loop1: p4 size 3657465856 extends beyond EOD, truncated [ 334.450929][T29513] loop2: p1 p2 p3 p4 [ 334.455188][T29513] loop2: p1 size 78398975 extends beyond EOD, truncated [ 334.464164][T29513] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 334.476713][T29513] loop2: p3 start 2127165541 is beyond EOD, truncated [ 334.483559][T29513] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:57 executing program 3: sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:57 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:57 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:57 executing program 2: syz_read_part_table(0x300000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:57 executing program 1: syz_read_part_table(0x100000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:57 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r3) [ 334.836438][T29512] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 334.845218][T29512] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 334.871614][T29512] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:57 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:57 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 334.880490][T29512] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 334.933629][T29602] loop2: detected capacity change from 0 to 264192 [ 334.936476][T29607] loop1: detected capacity change from 0 to 264192 [ 334.987222][T29602] loop2: p1 p2 p3 p4 [ 334.991404][T29602] loop2: p1 size 78398975 extends beyond EOD, truncated [ 334.999209][T29616] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 335.007910][T29616] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 335.037599][T29616] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 335.046133][T29616] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 335.101985][T29602] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 335.112513][T29602] loop2: p3 start 2127165541 is beyond EOD, truncated [ 335.119361][T29602] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 335.139049][T29607] loop1: p1 p2 p3 p4 [ 335.166185][T29607] loop1: p1 size 78398975 extends beyond EOD, truncated [ 335.176958][T29607] loop1: p2 size 1073872896 extends beyond EOD, truncated [ 335.188306][T29607] loop1: p3 start 2127165541 is beyond EOD, truncated [ 335.195144][T29607] loop1: p4 size 3657465856 extends beyond EOD, truncated 11:02:58 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:58 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:58 executing program 1: syz_read_part_table(0x100000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:58 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 335.321808][T29602] loop2: detected capacity change from 0 to 264192 [ 335.411431][T29659] loop1: detected capacity change from 0 to 264192 [ 335.466336][T29659] loop1: p1 p2 p3 p4 [ 335.470831][T29659] loop1: p1 size 78398975 extends beyond EOD, truncated [ 335.482567][T29659] loop1: p2 size 1073872896 extends beyond EOD, truncated [ 335.495045][T29659] loop1: p3 start 2127165541 is beyond EOD, truncated [ 335.502052][T29659] loop1: p4 size 3657465856 extends beyond EOD, truncated 11:02:58 executing program 3: sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:58 executing program 2: syz_read_part_table(0x400000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:58 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:58 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:58 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:58 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r3) [ 335.809640][T29596] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 335.818955][T29596] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 335.844075][T29596] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:58 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 335.852636][T29596] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 335.896709][T29690] loop2: detected capacity change from 0 to 264192 [ 335.960145][T29694] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 335.968894][T29694] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 336.000860][T29694] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 336.009529][T29694] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:02:59 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 336.058277][T29690] loop2: p1 p2 p3 p4 [ 336.074779][T29690] loop2: p1 size 78398975 extends beyond EOD, truncated [ 336.095142][T29690] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:02:59 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:59 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 336.204840][T29690] loop2: p3 start 2127165541 is beyond EOD, truncated [ 336.211745][T29690] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:59 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:59 executing program 2: syz_read_part_table(0x500000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 336.386097][T29746] loop2: detected capacity change from 0 to 264192 [ 336.427595][T29746] loop2: p1 p2 p3 p4 [ 336.431842][T29746] loop2: p1 size 78398975 extends beyond EOD, truncated [ 336.439743][T29746] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 336.447874][T29746] loop2: p3 start 2127165541 is beyond EOD, truncated [ 336.454698][T29746] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:02:59 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:02:59 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:59 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:02:59 executing program 2: syz_read_part_table(0x600000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:02:59 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, 0xffffffffffffffff) 11:02:59 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 336.771717][T29689] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 336.780387][T29689] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 336.809435][T29689] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:02:59 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:02:59 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 336.818145][T29689] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 336.888249][T29773] loop2: detected capacity change from 0 to 264192 [ 337.158029][T29773] loop2: p1 p2 p3 p4 [ 337.175827][T29773] loop2: p1 size 78398975 extends beyond EOD, truncated [ 337.218264][T29773] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:03:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 337.264067][T29773] loop2: p3 start 2127165541 is beyond EOD, truncated [ 337.270963][T29773] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:00 executing program 2: syz_read_part_table(0x604000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 337.414603][T29817] loop2: detected capacity change from 0 to 264192 [ 337.459734][T29817] loop2: p1 p2 p3 p4 [ 337.468082][T29817] loop2: p1 size 78398975 extends beyond EOD, truncated [ 337.478853][T29817] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 337.486797][T29817] loop2: p3 start 2127165541 is beyond EOD, truncated [ 337.493612][T29817] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:00 executing program 3: prlimit64(0x0, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:00 executing program 1: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:00 executing program 2: syz_read_part_table(0x700000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 337.734080][T29767] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 337.742771][T29767] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:00 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, 0xffffffffffffffff) 11:03:00 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\xff', 0x0) 11:03:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\xfe', 0x0) [ 337.792733][T29767] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 337.801223][T29767] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 337.827420][T29851] loop2: detected capacity change from 0 to 264192 [ 337.881318][T29851] loop2: p1 p2 p3 p4 [ 337.885492][T29851] loop2: p1 size 78398975 extends beyond EOD, truncated [ 337.905440][T29851] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 338.000099][T29851] loop2: p3 start 2127165541 is beyond EOD, truncated [ 338.006967][T29851] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:00 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:01 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:01 executing program 2: syz_read_part_table(0x800000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 338.237691][T29903] loop2: detected capacity change from 0 to 264192 [ 338.291127][T29903] loop2: p1 p2 p3 p4 [ 338.295859][T29903] loop2: p1 size 78398975 extends beyond EOD, truncated [ 338.305059][T29903] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 338.313655][T29903] loop2: p3 start 2127165541 is beyond EOD, truncated [ 338.320565][T29903] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:01 executing program 3: prlimit64(0x0, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:01 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:01 executing program 2: syz_read_part_table(0x900000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:01 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 338.722370][T29861] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 338.724301][T29936] loop2: detected capacity change from 0 to 264192 [ 338.730947][T29861] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 338.760590][T29861] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 338.769290][T29861] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 338.796852][T29936] loop2: p1 p2 p3 p4 [ 338.801679][T29936] loop2: p1 size 78398975 extends beyond EOD, truncated [ 338.814908][T29936] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 338.826310][T29936] loop2: p3 start 2127165541 is beyond EOD, truncated [ 338.833574][T29936] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:01 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, 0xffffffffffffffff) 11:03:01 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:01 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:01 executing program 2: syz_read_part_table(0xa00000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:02 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:02 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:02 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 339.110759][T29977] loop2: detected capacity change from 0 to 264192 11:03:02 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 339.389543][T29977] loop2: p1 p2 p3 p4 [ 339.398645][T29977] loop2: p1 size 78398975 extends beyond EOD, truncated 11:03:02 executing program 3: prlimit64(0x0, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:02 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 339.429684][T29977] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 339.438338][T29977] loop2: p3 start 2127165541 is beyond EOD, truncated [ 339.445151][T29977] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:02 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:02 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 339.506731][T29977] loop2: detected capacity change from 0 to 264192 [ 339.556546][T29977] loop2: p1 p2 p3 p4 [ 339.563727][T29977] loop2: p1 size 78398975 extends beyond EOD, truncated [ 339.572154][T29977] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 339.580233][T29977] loop2: p3 start 2127165541 is beyond EOD, truncated [ 339.587138][T29977] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:02 executing program 2: syz_read_part_table(0xb00000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:02 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:02 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:02 executing program 0: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x12', 0x0) 11:03:02 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:02 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000002c0)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 339.983741][T30045] loop2: detected capacity change from 0 to 264192 [ 340.017657][T30045] loop2: p1 p2 p3 p4 [ 340.022063][T30045] loop2: p1 size 78398975 extends beyond EOD, truncated 11:03:03 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:03 executing program 2: syz_read_part_table(0xc00000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 340.029674][T30045] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 340.037446][T30045] loop2: p3 start 2127165541 is beyond EOD, truncated [ 340.044312][T30045] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 340.157560][T30078] loop2: detected capacity change from 0 to 264192 [ 340.209227][T30078] loop2: p1 p2 p3 p4 [ 340.213437][T30078] loop2: p1 size 78398975 extends beyond EOD, truncated [ 340.221006][T30078] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 340.228578][T30078] loop2: p3 start 2127165541 is beyond EOD, truncated [ 340.235798][T30078] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 340.385134][T30007] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 340.393890][T30007] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 340.421662][T30007] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:03:03 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x0, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:03 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:03 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:03 executing program 2: syz_read_part_table(0xd00000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:03 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 340.430948][T30007] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:03 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 340.516245][T30105] loop2: detected capacity change from 0 to 264192 [ 340.550229][T30104] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 340.558802][T30104] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 340.600388][T30104] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 340.608864][T30104] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 340.736212][T30105] loop2: p1 p2 p3 p4 [ 340.740905][T30105] loop2: p1 size 78398975 extends beyond EOD, truncated [ 340.766726][T30105] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 340.777113][T30105] loop2: p3 start 2127165541 is beyond EOD, truncated [ 340.783949][T30105] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:03 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:03 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:03 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:03 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:03 executing program 2: syz_read_part_table(0xe00000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:03 executing program 2: syz_read_part_table(0xf00000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 341.036714][T30159] loop2: detected capacity change from 0 to 264192 [ 341.066388][T30159] loop2: p1 p2 p3 p4 [ 341.070592][T30159] loop2: p1 size 78398975 extends beyond EOD, truncated [ 341.079606][T30159] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 341.088170][T30159] loop2: p3 start 2127165541 is beyond EOD, truncated [ 341.095160][T30159] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 341.108438][ T1033] loop2: p1 p2 p3 p4 [ 341.112982][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 341.120894][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 341.128912][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 341.135712][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 341.207308][T30159] loop2: detected capacity change from 0 to 264192 [ 341.256127][T30159] loop2: p1 p2 p3 p4 [ 341.260392][T30159] loop2: p1 size 78398975 extends beyond EOD, truncated [ 341.270287][T30159] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 341.280078][T30159] loop2: p3 start 2127165541 is beyond EOD, truncated [ 341.286923][T30159] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 341.300802][ T1033] loop2: p1 p2 p3 p4 11:03:04 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x0, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:04 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:04 executing program 2: syz_read_part_table(0x1000000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 341.305163][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 341.315294][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 341.333664][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 341.340754][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:04 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:04 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) dup2(r3, 0xffffffffffffffff) [ 341.386095][T30097] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 341.394758][T30097] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:04 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 341.432808][T30097] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 341.441451][T30097] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 341.524614][T30217] loop2: detected capacity change from 0 to 264192 11:03:04 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:04 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:04 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:04 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:04 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 341.806909][T30217] loop2: p1 p2 p3 p4 11:03:04 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 341.835380][T30217] loop2: p1 size 78398975 extends beyond EOD, truncated [ 341.857035][T30217] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 341.865589][T30217] loop2: p3 start 2127165541 is beyond EOD, truncated [ 341.872427][T30217] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 341.947041][T30119] print_req_error: 24 callbacks suppressed [ 341.947056][T30119] blk_update_request: I/O error, dev loop2, sector 263946 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 341.956508][T30138] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 341.976904][T30114] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 341.980475][ T853] blk_update_request: I/O error, dev loop2, sector 263946 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 341.989593][T30217] __loop_clr_fd: partition scan of loop2 failed (rc=-16) [ 342.000004][ T853] buffer_io_error: 13 callbacks suppressed [ 342.000019][ T853] Buffer I/O error on dev loop2p1, logical block 131968, async page read [ 342.020352][ T853] blk_update_request: I/O error, dev loop2, sector 263948 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 342.032929][ T853] Buffer I/O error on dev loop2p1, logical block 131969, async page read [ 342.041428][ T853] blk_update_request: I/O error, dev loop2, sector 263950 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 342.052924][ T853] Buffer I/O error on dev loop2p1, logical block 131970, async page read [ 342.061441][ T853] blk_update_request: I/O error, dev loop2, sector 263952 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 342.072770][ T853] Buffer I/O error on dev loop2p1, logical block 131971, async page read [ 342.081241][ T853] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 342.092600][ T853] Buffer I/O error on dev loop2p2, logical block 33008, async page read [ 342.101539][ T853] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 342.112898][ T853] Buffer I/O error on dev loop2p4, logical block 33008, async page read [ 342.138524][T30217] loop2: detected capacity change from 0 to 264192 [ 342.210804][T30217] loop2: p1 p2 p3 p4 [ 342.216275][T30217] loop2: p1 size 78398975 extends beyond EOD, truncated [ 342.232753][T30217] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 342.241142][T30217] loop2: p3 start 2127165541 is beyond EOD, truncated [ 342.248080][T30217] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 342.316134][T30194] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 342.324775][T30194] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 342.351319][T30260] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 342.375652][ T616] Buffer I/O error on dev loop2p4, logical block 33008, async page read 11:03:05 executing program 2: syz_read_part_table(0x1100000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:05 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) dup2(r3, 0xffffffffffffffff) 11:03:05 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x0, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:05 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:05 executing program 4: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 342.442658][T30194] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 342.451229][T30194] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 342.533495][T30291] loop2: detected capacity change from 0 to 264192 [ 342.652628][T30298] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 342.661162][T30298] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:05 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 342.710621][T30291] loop2: p1 p2 p3 p4 [ 342.714856][T30291] loop2: p1 size 78398975 extends beyond EOD, truncated [ 342.724081][T30291] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 342.733169][T30291] loop2: p3 start 2127165541 is beyond EOD, truncated [ 342.740072][T30291] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:05 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:05 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:05 executing program 4: io_setup(0x9, &(0x7f00000000c0)=0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x1f}]) shutdown(r1, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x81, @local, 0x3ff}, 0x1c) sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 342.805907][T30298] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 342.814424][T30298] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:05 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x4c811) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) ptrace$setopts(0x4200, 0x0, 0x81, 0x0) [ 342.942602][T30291] loop2: detected capacity change from 0 to 264192 11:03:05 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet(0x2, 0x4, 0x2) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg(r1, &(0x7f0000000080)={&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x1, 0x3, 0x0, {0xa, 0x4e24, 0x4, @remote, 0x20}}}, 0x80, &(0x7f0000000000)=[{&(0x7f00000001c0)="b8ff95835a80e64768f719268921efb4e81b5b23a8af359807c500a865afa6ca7adbd8accd30d185cfac44ba507a7ba7b6d4d8c7fc568f2e67000e0f03d7a5ac1f64e8558d0559b62530a29b397f00787a2bcc284c0a03e9af4ee11e061bb05e3355e0fb00d84cd5f6c8643190659db83be4f5833c9d9af4fab06a7083b3260b4d8626e5ea1f5eaca8640f3f8a51a81db0003e75967681fb2d6b9f2548390b03e24d9833467009e21ff1611cd4887826ad46126bd900d6f446296b6790aba2881ef83ef9e8db75b77808bb8745e5e635e8ec5045c3a3ab6088805095f95d929e632db1de78529451055db6fe16a735439625e2583e821fbfdad6615aaaec0bc8c79e818a54a5391e1f15077178ad8aeef610f2395f917a607b7b6f0f269e4dbc732499540062c5273759fb8cf4dca19fe5fd9ad7b45a6d6aa891103c8e030a1f756b75577cdb5d5c57518b12ab6965745ac02e818f534952bdb29cb500d983d891ce64a5b2aaa8f27436e266fe045b4f970e214187ac47fa05a595eb2e5dfd1700bdbbb66486dbbd33ea9345d57b7aa8aed912c916b4eba684931ff733dfd5ae37ed147e6996ae5553c7177457f2e3bfe0a25c8a177b0830cf7fd47e095fa11db2ffa55cb9f76e92d442c3926f5d2529e344380a1455175837f36632906786662b4df85a978972fd7bd379c4f1ceeb7180265d5a10b84a1583c258c97e81682e799a90816431731334178421120fbc9f1d10462e51a25182b5c8324ca89dedb2a2bcd2facc2983179cc79a1c9b0a172747721660ed4b8783474f767b44f7bfee795fa495527cd71086001358df287957b326d3959e46ec84d228e6aab081fc1d74ef448801759ab249d6d925d6ef8e6cf3edf10d54e842afb775de4715a5cfd52b70baee71583216a7495fe566aa04b4ecd984b70cf3b542bd42fa971c7a279a0c962e9fce6f6b11d7262e597634574fda041561896d7f5da434e51e8f08501615c19d5d626351fef933b065e4a718dd01a883e2f954eb69423eb34746956972af0a2a23297202bfbc4633f0843985366669c28ed119849f681af8c2fdfdd2cdbe185aa3cb1a9a6907e5de2d51f7a816748b066a823b25ba3d9f7e15cdb497da985c092e0ac659c98b715078318fd3d69ff301969e77890b97ed5c947a2da87b54f9518fb3819c8de1fd4d8c22793b55135cb7e217713cb2e6e75abd44eaf040f635b0283ad8640b9ada995f583a70f22d6729a3197cd6152db9e600c424ac01918d41f2701a107a09b301d223b644b5d2c5476f48dfc3daa7b786ede870ca7a1f613001936a500d944954a60181ef815b3a17bdf317c129c473db2e33fa0ce91d3ea9c80b315ff493869ae422eb57e72536022409aa5e56a38e1edfc2e2bf199bbc5ee768d4121e53d68388c2c13d174cc2d340d815198652dc3d67d059e7bc247ae82c247f6fd867808e4fb5e1bcb36f1aa2711fd34a69e9db64e88cf3145b161ae8c061f0cdf9fd0032ed72f2de7b1fd1661d83211e90bdf1a3e1dfb8f5ff23974d991f107404df11b14d63659f28a1b1536247fd97204f39c6cc0e8ba8b4f0a4dd1c148b8571c96b096dcd018a0d503c6301ca8c5a1ad4cd2641fd45ed13afff61f6cd9d9473ddc8d5820adb4bf374a8ed2e3df79d57c97f2e46cae3a5be14775a99ec20ef49dabb10651562c87ea1f2f6cf477fef22357af30428fd9e63719fc219338dc90b009d99b21ec16600d60f4bfeb14ee0176972ceb089f1c08258e025747d3bc006a00274848ac796abf21f746bdb1e17cf614e6da003ea5b49ad7b62a1af4326f0ad8136b39b28a9c1c13adb7199a3dd140d4c9e1e5805f7d2740d7805d471d1449c9a41488fa4d0160399fce1144c5a1037b0477883db658d8549f4909086e0dbd6f1e2271a64ef5b68e6251fb3a4b0dd1ed8d4af4a36335d40fb551e7ce2679e052e6718c3b6a11c40f60e5f573946c2104880d62265dc22695a6a6ec82356e68b254558d0d01b8c06b095ff6d56a92c60395d4fafb356a0ecc637a0afda847f54160b51bf0639b91acc5a720b29d3d6313579555005a2beb3511a31a8ac8b89fdced94b3f99f0cccb9b43dc950aa3f7c4e69e5dd6cac2f88e1801bb18c1c8eacb6b44f267cea693479f4f6d53401668bd26f05df55442b50c232108d52c2bab18b5f46e22f26cb783c53855b8716cea6389b069aea811c7006a02e7a2f998709aa730c10aafed1c08763181af33c775d3bb79042a4ebd6bd3628165b6266baee6bb390a3ac0f2b1505889cca5a90c33b71358b381022113d65112499f237c175dad288a9007e9a278e36d75f2c74b507a6a16f30bd812b83628b77050243243c34336f3c900e0fbf3d077ee8fe6b313d72f062510c5cf3f23544ab510e25a883d1287c0b54edcf85240287f9e46fad3b91be319dd67ba295df8e86efe909a9d413ba24656da13f3fa1753e4bd03c760562410d7912cac9fcb2c911079297d81bf9968a93922bd37a07b463fb2b6199269fab10fd50c8dbb0ba2383c8e428af024ce8b05bfbdd2e3a803f36988c44f61260cba1c6cc056dd5646de6ce3827c6c88fd3cce2a14a9e8d64b68b435831101e26858bab3ca3145fc2debaebd70396877474004ccc0f9b08b48cd5c83cef6cdfc545b3df4960aa02cb2fa380fcb9abab4edc7f4db2ac3e24db2c2abed7c378963fccc808f88d95daff0e841e6c30ce7eabbb3a598dbee1651330acbbdaa356af40bbcb9ce2e8e6644e860087470c18a04ba562189ff2138254974fe59c0bf796012c1d2f6e8ac1df4a75fa56105e400012033a6d07f84fa1f6c583fa84453abe6c211c4ab32fd7d4d65851c0813e953859c7ce1a7acb9b350612cff662255ddba1ce9185d90c2aafdd81cf61937356da9744c71150ec6a887651544656219bc269d23dc0b617b8635c3349b16134d4c300057fab55c8d21799a22747687794052275a1398ec0d3700d8078175fe6ddc6d275bc0895a5e79e54c9b3eefd4d9f68e67a435580e7606d3ad50a289af7a0f83f0c27d2f604d8d656508b3a97cb6fe436456759cedf1c44c509965a585edd23194bed62f7da4e2d4e1729875ae39dfa364bfdef45647c278d298c0f228591b252e15f679c1e0debfceb505b281a4799e5d6dd824aa13f78937931321d5d71d27889c51d9e08b2400611d516dad555f6b18143e7ee237bb23d6dca964da8816ee1cb5dac58b2df04dc5531503bb27c0828cc18da676ebdd089b163ce1c1aa93ef42dd9e66398914eb2558ba3d140aef888c8d29d8cf3723a06fd413d400ff5bf7c8e479b61f55759d89a8f29edd74a47040d7e82762fb594e0aaa9c9ef40839dabad094355623adb34717ba378f90d6d61f3730cd1615691b1e882a8179c5fdc51a6d63f22bf11f09c616d866d811a01b3e0d2f3e853ea4d444d2ec3526e83efb7f33808a46d5c710b504cfe9b687d03b8a4f71a161c3a110bf903008ae16b026e3688b9fed06d30b462f1c8ee8f6556f816b098c83620d90b907c5d14c3b586665514802e88d61a94ce3818f585f3b1af3082cd9b33e3a15e9a303157995401a1ebdac1a6df889ee2da2995499457d21abd5840953f172d9aecdc885c4462c7bd9ae4a8dc7af10267c996ffca13a0ba6b014d48613567dbc4bcbbac022140c0fbc325ea85dca5790f9af7c5827abe61d088d8facb39ca2db23a5b0068731f940ec217f95e0164cba7a0911bef3d1c356c4d22d25f8012186d03d30f26cfc394b23904c3f93be9dcf3162ee8c9a35eb9be8f679c56eb226e23d622cecb42441a17338c38bcba7b73ef6b84973af663a655693cc6d977ed5a017367acd5792f5f7964ad8cb00daa8eeabfe7f04e2a5a518cb18c19a15f3da805be8b9cc08f8794632ff9b6ada11c873986cb141874a7fbdbddbee35f4acdab142b189077c2a90d0d8ca38a97e95121c888118b14f5838a4dafcb1036230715b87ed94c2adb56bab36a14f46ea31b1408eb47f4a2a3ee489e8b2d2f5a0bf3848ba8fba45d4bf62934202eeb4113856ded99d386716817f2424fab140e018ed2e6da21457e03e9a02d2e3521bdaa4ea682f38a86c2e48b386017ac8f680bd1ee7d1b7ebd26987c10533623966ae0ded46de8a7a44fd5b85c5d94c691c77b75f0da34436ee8cf52cb47f62ad981be44fb08b2f000960589482795c60268724f5c2e892563d7ce941f536eac8239145321db7d26e095d2d69142fc617efe069f6c677d67ff9c9e06ac0862f0bed8b35fca196344f91dda914b753613d21a97ee50c4585a2d729c645fff13d66340bbcbc8fb6119b3f8e4c651a1f496c996c20a6d2adb88ac6c8ff7f1b0d669b9f09353bb78ba47c7db80225ec17402ed3a8f7c16a475385cc8582a44adb31b4ba820168852c3b1f13a410d9569c6fdca1f24c4d3f81ddb3b1fc569b9de2d1151e3969071bd107f7ad9c5e5f45d857eda50d4c7d9935f7be6db25ac38d344c0790a591e49b8041b48c0d752d721a07e94dbc2bca3811984b9c59096b42f837f5c7e7cf4759bc1f9c5e99721335410e0f6135bebf73553b36873b5a9881a3f8f2403cd3df70cbf9514a0f3f3f05c8630fc124b2cc025ae8c4da0696798ca57b06aaae7d39272865621a2fb57b53b7fff5799fb2183a03c22103b51f4b87f016ed09c860bcdcc48ff8523d642c9b92bdabfeb3e15cd4c630def2d28444fc65f8146c73150e51d12cbd6d6b6d184b34ce00b193e4b596a044718576324857ebb2ab08e5716b5ad7f8950d1605406226c967a9665cb3aa37b5429b3e35e0b220d4195b370569d5c1998e020a35fb769a94d4774eabc58f0966c9a462070996e6289dd7d7be8d0c4db541e8ab96e4ac3f0641a74fdeda9f2b3b86894b6f09707409bcfb851309a3d54a00611ed92e903ca978d5dfd5fdb4fcd0767d9c3475e519942ae9052026eeacfda864cfeee099fb6cee72fe5bbbb028b6ccbbd1d045736702cabece12f9aa8dd52dc1368c5c52d90f987d610e8adc6c5f53ee105b69fbb56497105def62a36a03cc825b4aa1c4e4503c742ebe23a56f1bcc743b7f5a62865be03d44e5fe13a6343a3c203b9973c27ce8f5d66adb85285026874dd52e9f7a3fbb8ce690854ccbefd64f2f8ae99cb929d35487ca7db1df79d0bed45c05319f8cfe736522ec69bcd2f5d1e8a450fffc8c6d857cddd8168e4c6056028a5108dd3534ddac8963503385e382a787f421d715fb46cf9828d55fd281c76b50e1bfdef4c1c4a9b76307da4a4e2b9925c5a5e051abae47d3538b8188fbfcb7ba77116151c8b13ee7f0cebbf37e13dbfc794d3d073a373683b95ce66a6b5bbe927c15e502fc9404e3f63bf1dc43d930ff425f7b514f87e9984a0b43d87286cba2ce548acfd67f4ca86747fc08bded612391aa0ac4c6cdce1c62b8dfa08a07dcf4cb45bdd69079480e2fee9ec065dbb47b8422c6961c05ef10e759fb6a0f40d299c83eefc92697730f9103eb8a6b553cc929e59e6fb95b3ffeca890fedf38b6e7a12d9b3a6329cb543a74240d8cc0e2300f898ef4b8bb154c1f6b39a9bc4c7552da0b5f811f8e19a8b2fa9434bb9cbc41ad585d7dde7c7c262200395a50b5ab4efdfdfd3821ee1b73bf3ffcef4e098cdacb20788469d27205d629bbd1de68d6179d8e67af9ade2b3b1a81525108b0632b23011a535c9165d0376f9348598e11be5926076dadf11f5c48f0611275316f2a33fbc1c27aa4b73df82217778658f493970b768374cd59af33c20554439905ff9320bfd02a4b6544a5d", 0x1000}], 0x1, &(0x7f00000014c0)=[{0xe0, 0x113, 0x1, "edf40b0eb587045af6bd8ec7b1ac498fd403bf57a56a7b37abf9eeec259154eb17e9bb742e282c46cc2eeca24e884687a5fdebfd623f797bb1a5c5de4a3680164aa1a2358cdc6f4fd50f3ef629f01b615ad8e8165d0c4d078d7d637ef3d088cf9653d59de8d4d7e40100000031e006ce4b761157fa69d207a1f2b94fc5936ace5747afecf36bf43ae49e8c9808a7d7a5ab34ecd3799eb3b4f5d2ded29387b9024a0dc71f6db2eecf31b279d473e77f29c08bc7366185678d9083bb0d47d91376a0c054aa7f18083f690f06"}, {0xffffff2d, 0x8b, 0x5, "eb5403d6e75d6cc5a4ffb40fde500913e594a8ee7ebda95140f04ad60a945dc5b4e39d45191957968661559b2446b2796ce44fa651f17920e2c3ed73d274caad404e73ca3fb134e844ab37ee596a3d75183d8362f4ff4ca0aff7e99b827671250793300d45e706202ddb9f4250cfa310034e33ac5981d617e44b44a154fccdba69647089c787d6c3e8018311a0291510d578e07eacd008f815aa7dcb2d902c587779dddd79fce265bf0ed0cad758bf7eeea9cc22d1bed9e7f762b5f7783f3f3b438de853772cac45add7b4ed6acd9d1f380ec441c061ba317a44fcd267"}, {0x18, 0x5, 0x8, "92eb2ea1d5d8c1c4"}, {0x100, 0x11, 0x1, "9353d7e99e1e68e4b92cbc6b19daeb644e050cb16671a57a525305788cf5594ab6f699455003a4cd345772a37ae8b0c926dc11e7143e4d9fef77501a7885df57692185b7f1616941a247e8fb9a21918b61a8dead6219cc37d4672c2fee9c74f9b32ef5ecb62999788de5a8a5c2a18a4ab331c082494385310ff11ca6807916db5cdd8e715d5b8c794fb1a8ee8f0451dbf1433ebb0f08db72db09d26805a8164a3d672fe06df252fa94fa72fec6bb69fbed619cf2db89dc9c7dd23cbebe66f9343ee1d96a6e7b1973e01d77c9dadc3b5ce170b395a9228e4095384b6f575d9a4936cd72f4eda22f5b9d9e66d169d539f94d3a55186b5e9d2687642935c1eecf6199dfa936"}], 0x2e8}, 0x1) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 342.988100][T30291] loop2: p1 p2 p3 p4 [ 343.003486][T30291] loop2: p1 size 78398975 extends beyond EOD, truncated 11:03:06 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) r0 = add_key(&(0x7f0000000100)='user\x00', &(0x7f0000000200)={'syz', 0x3}, &(0x7f0000000240)="54dc3c3bd4a77f4f559b3f7ca92c277d5ce0dfa02006112abdb1e1fc693781b303654c32928fc8e5a5f02e757f957a6ec7f0ba5d98bf0d272d593fd0d411b9921d4364cc1f6443a5549821fbd14cf541806e739ecf4d0e6ae7a14b3c9349602e62f2ca6619f10ac12b9434ffff0000ba754d1400c91bee46879f4da67b4ed4fa2133c652215284021edeb46f230efa17", 0xfeef, 0xfffffffffffffffd) request_key(&(0x7f00000000c0)='blacklist\x00', &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', r0) 11:03:06 executing program 2: syz_read_part_table(0x1200000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 343.043547][T30291] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 343.061440][T30291] loop2: p3 start 2127165541 is beyond EOD, truncated [ 343.068364][T30291] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 343.233539][T30367] loop2: detected capacity change from 0 to 264192 11:03:06 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) dup2(r3, 0xffffffffffffffff) 11:03:06 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) wait4(r0, &(0x7f0000000000), 0x20000000, &(0x7f0000000140)) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:06 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) keyctl$set_reqkey_keyring(0xe, 0x7) r0 = syz_io_uring_setup(0x2de5, &(0x7f0000000140), &(0x7f00000ea000/0x3000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x10001}, 0x0) io_uring_enter(r0, 0xa2, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 343.307904][T30367] loop2: p1 p2 p3 p4 [ 343.313346][T30367] loop2: p1 size 78398975 extends beyond EOD, truncated [ 343.322827][T30367] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 343.332344][T30367] loop2: p3 start 2127165541 is beyond EOD, truncated [ 343.339533][T30367] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:06 executing program 2: syz_read_part_table(0x1300000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 343.629369][T30396] loop2: detected capacity change from 0 to 264192 11:03:06 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 343.806081][T30396] loop2: p1 p2 p3 p4 [ 343.811461][T30396] loop2: p1 size 78398975 extends beyond EOD, truncated [ 343.826755][T30307] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 343.835281][T30307] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 343.847599][T30396] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 343.858963][T30396] loop2: p3 start 2127165541 is beyond EOD, truncated [ 343.866068][T30396] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:06 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:06 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) keyctl$set_reqkey_keyring(0xe, 0x2) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) clone(0x20002200, &(0x7f0000000140)="ac21f8563e4009cb00ae9fe78887b01676c22f9f211926cfdfa26142055d479fee1b52b52f0dcb498ca0033018af5acc627451df66d40ba67c7f92fa610a22f2f095527a4bd6b8908228c31ae081037c92db430add04311724787a07c1aa698fbf02e7e833a1805455fe34cbdc18013f0c9b7f6de3b99ba70f", &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000001c0)="0cb3b144e6df60d2dd7b222865ff7f195eb73a58dd7f339f6abc3655e25b67761f975997a3fb43c3a2a5a9ee593c9f8c4d2133859a5c8ce7") r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) tkill(r0, 0x29) 11:03:06 executing program 0: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) keyctl$set_reqkey_keyring(0xe, 0x7) r0 = syz_io_uring_setup(0x2de5, &(0x7f0000000140), &(0x7f00000ea000/0x3000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x10001}, 0x0) io_uring_enter(r0, 0xa2, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:06 executing program 2: syz_read_part_table(0x2000000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:06 executing program 0: syz_read_part_table(0x1100000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 343.938152][T30307] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 343.946672][T30307] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:06 executing program 4: sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000006280)={&(0x7f0000003240), 0xc, &(0x7f0000004640)={&(0x7f0000005f00)=ANY=[@ANYBLOB="33030000", @ANYRES16=0x0, @ANYBLOB="000228bd7000fcdbdf251500000098010680cf00030072b70221748a447cf2ef3dfb0c77f11a3007ad8a9422f9470cac6678ad8f4f9b11f0f99ebbc77e833a5710174adbb220a0adf310273012fd4aa45b92c8afded6e7184658a751407bb2a843f4c44c2c67169c5fd928fa2d88c579cc0713eea8f39de5de7d4a68422ed86c45703484b1d393af1fc7c8b5d50c1dc5911eaf08626d4e4fdb8d0c1fa4e5ba4b67cf434ed7a0e3998e0220b0e1db02319f5f79970fcb13a457e8120ed7433692a8be2da098fc20cdb26fb819bd63bc44ee442c2502223af5ecd6a1a101ddd5af6b00ae00030071acbf0a25550c2a04f0039ced0558e51eaec71be11a9cf9e4c0b15e6d663f8a92107481c19d8a5eb5d8c668848f13c9d83099806a5235c2dcaea13f5e2e0e60ccfefc05af6e953ffbf173428e9ddbe998b1754049e6d936e9b64a62c5ea5f8c172f250c0ada56e43e076c84ff84e10ac438378a094cc996e1dc86661a5543e5892f22a7445780383513fc4bb6b9b35a910279423e89cf7d6ac81bd45fc746f92bde57f04857d8ff55b800000400020008000100fffeffff0800010002000000180004801300010062726f6164636173742d6c696e6b00003000058024000280080001000b000000080003000800000008000400fe06c613080002009b00000007000100696200003c0104800900010073797a310000000014000780080003000000000008000200080000001c0007800800010014000000080001000400000008000300d8ffffff1c0007800800040002000000080002000400000008000200740000004400078008000400000000000800020007000000080003000400000008000200ae000000080001001800000008000400ff030000080003004000000008000400020000003c000780080002000100000008000100060000000800010005000000080001000c00000008000200ffffffff0800040080080000080003005a0000000900010073797a31000000000c00078008000200320000003c00078008000400ff03000008000400849f00000800020006000000080001001b000000080001000b000000080001001100000008000100110000000900010073797a31000000001400098008000100020000000800020004000000"], 0x344}, 0x1, 0x0, 0x0, 0x1}, 0x4004041) sendmsg(0xffffffffffffffff, 0x0, 0x0) io_setup(0x9, &(0x7f00000000c0)=0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x1f}]) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000005d80)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000140)=""/101, 0x65}, {&(0x7f0000000000)=""/21, 0x15}, {&(0x7f00000001c0)=""/244, 0xf4}, {&(0x7f00000002c0)=""/79, 0x4f}, {&(0x7f0000000340)=""/216, 0xd8}], 0x5, &(0x7f00000004c0)=""/249, 0xf9}, 0x20}, {{&(0x7f00000005c0), 0x80, &(0x7f0000000a40)=[{&(0x7f0000000640)=""/231, 0xe7}, {&(0x7f0000000740)=""/118, 0x76}, {&(0x7f00000007c0)=""/230, 0xe6}, {&(0x7f00000008c0)=""/135, 0x87}, {&(0x7f0000000980)=""/180, 0xb4}], 0x5, &(0x7f0000000ac0)=""/4096, 0x1000}, 0x800}, {{&(0x7f0000001ac0)=@can, 0x80, &(0x7f0000002ec0)=[{&(0x7f0000001b40)=""/114, 0x72}, {&(0x7f0000001bc0)=""/4096, 0x1000}, {&(0x7f0000002bc0)=""/122, 0x7a}, {&(0x7f0000006340)=""/236, 0xec}, {&(0x7f0000000080)=""/23, 0x17}, {&(0x7f0000006440)=""/261, 0x105}, {&(0x7f0000002e40)=""/97, 0x61}], 0x7, &(0x7f0000002f40)=""/239, 0xef}, 0x800}, {{0x0, 0x0, &(0x7f0000003380)=[{&(0x7f0000003040)=""/254, 0xfe}, {&(0x7f0000003140)=""/195, 0xc3}, {&(0x7f0000003240)}, {&(0x7f0000003280)=""/153, 0x99}, {&(0x7f0000003340)=""/24, 0x18}], 0x5, &(0x7f0000003400)=""/46, 0x2e}}, {{&(0x7f0000003440)=@generic, 0x80, &(0x7f0000004940)=[{&(0x7f00000034c0)=""/4096, 0x1000}, {&(0x7f00000044c0)=""/182, 0xb6}, {&(0x7f0000004580)=""/143, 0x8f}, {&(0x7f0000004640)}, {&(0x7f0000004680)=""/160, 0xa0}, {&(0x7f0000004740)=""/57, 0x39}, {&(0x7f0000004780)=""/71, 0x47}, {&(0x7f0000004800)=""/244, 0xf4}, {&(0x7f0000004900)=""/48, 0x30}], 0x9, &(0x7f0000004a00)=""/39, 0x27}, 0x8}, {{&(0x7f0000004a40)=@sco={0x1f, @none}, 0x80, &(0x7f0000005d00)=[{&(0x7f0000004ac0)=""/110, 0x6e}, {&(0x7f0000004b40)=""/81, 0x51}, {&(0x7f0000004bc0)=""/182, 0xb6}, {&(0x7f0000004c80)=""/4096, 0x1000}, {&(0x7f0000005c80)=""/56, 0x38}, {&(0x7f0000005cc0)=""/38, 0x26}], 0x6}, 0xfffffff9}], 0x6, 0x40002101, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_dev$char_raw(&(0x7f0000006300), 0x0, 0x40) ftruncate(r2, 0x10001) keyctl$set_reqkey_keyring(0xe, 0x1) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000062c0)) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:07 executing program 0: syz_read_part_table(0x1100000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 344.055478][T30427] loop2: detected capacity change from 0 to 264192 [ 344.116398][T30427] loop2: p1 p2 p3 p4 [ 344.120579][T30427] loop2: p1 size 78398975 extends beyond EOD, truncated [ 344.128921][T30427] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 344.137079][T30427] loop2: p3 start 2127165541 is beyond EOD, truncated [ 344.143889][T30427] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:07 executing program 0: syz_read_part_table(0x1100000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:07 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r3) 11:03:07 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sendmsg(0xffffffffffffffff, &(0x7f0000006b00)={&(0x7f0000006840)=@xdp={0x2c, 0x4, 0x0, 0xe}, 0x80, &(0x7f00000069c0)=[{&(0x7f00000068c0)="fff181d3b66929", 0x7}, {&(0x7f0000006900)="b1a4163081d53980f6bef96fca858e2d58f1e345df6e2a99ff52dc6ec53f9e817884c533a973d730f875c95f249bb4b9d7dd2b38bbd1afca2a29b4482b792f35f07a8ffe4624eb14c6acbed36854a0822570f09e0d9e3e28da33ac2e8efc71ad82a1d43db71fe2a21c70de5c4ac9bb6128a8474a2edbda23517642d1d974ae15fbc5f0678f3482ae89e54b896cbdd3bbbce857e09986f8878f", 0x99}], 0x2, &(0x7f0000006a00)=[{0x50, 0x113, 0x3f, "b5a0d19e25fb34a4bb28b0d1cac790206746eaf3fb249fb691fd9cab492909dc0dc2363d06f21e3f00d1fa92445f79c8c2e281abdb9a0ef57e20ea8b82dc4a"}, {0x80, 0x29, 0x100, "decb2363e8f23cb63fdea3d0675e88885ca427edaf449d55b7af8a886947c2bcd1b2ee54956179d5b5effdb4d269ee756b354587003ef9188c3efdbb90856ba6d57d557beda84390c12c611ae2ea1f0f4b8c08a697c049e3dd0ca5b7977a383f5c1c2f7f6c869ffa5f7f20016d"}], 0xd0}, 0x40000) keyctl$set_reqkey_keyring(0xe, 0x1) r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000080)=0x1c, 0x80000) recvmmsg(r0, &(0x7f0000006680)=[{{&(0x7f0000000140)=@hci, 0x80, &(0x7f00000003c0)=[{&(0x7f00000001c0)=""/236, 0xec}, {&(0x7f00000002c0)=""/237, 0xed}], 0x2, &(0x7f0000000400)=""/30, 0x1e}, 0x88}, {{&(0x7f0000000440)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c}, 0x80, &(0x7f0000000880)=[{&(0x7f00000004c0)=""/172, 0xac}, {&(0x7f0000000580)=""/46, 0x2e}, {&(0x7f00000005c0)=""/120, 0x78}, {&(0x7f0000000640)=""/248, 0xf8}, {&(0x7f0000000740)=""/109, 0x6d}, {&(0x7f00000007c0)=""/21, 0x15}, {&(0x7f0000000800)=""/84, 0x54}], 0x7}, 0x4}, {{&(0x7f0000000900)=@can, 0x80, &(0x7f0000001b00)=[{&(0x7f0000000980)=""/243, 0xf3}, {&(0x7f0000000a80)=""/71, 0x47}, {&(0x7f0000000b00)=""/4096, 0x1000}], 0x3, &(0x7f0000001b40)=""/212, 0xd4}, 0x4}, {{&(0x7f0000001c40)=@pptp, 0x80, &(0x7f0000002f00)=[{&(0x7f0000001cc0)=""/4096, 0x1000}, {&(0x7f0000002cc0)=""/2, 0x2}, {&(0x7f0000002d00)=""/46, 0x2e}, {&(0x7f0000002d40)=""/18, 0x12}, {&(0x7f0000002d80)=""/116, 0x74}, {&(0x7f0000002e00)=""/209, 0xd1}], 0x6, &(0x7f0000002f80)=""/221, 0xdd}, 0x934d}, {{&(0x7f0000003080)=@in={0x2, 0x0, @broadcast}, 0x80, &(0x7f0000005340)=[{&(0x7f0000003100)=""/46, 0x2e}, {&(0x7f0000003140)=""/4096, 0x1000}, {&(0x7f0000004140)=""/178, 0xb2}, {&(0x7f0000004200)=""/63, 0x3f}, {&(0x7f0000004240)=""/46, 0x2e}, {&(0x7f0000004280)=""/83, 0x53}, {&(0x7f0000004300)=""/4096, 0x1000}, {&(0x7f0000005300)=""/17, 0x11}], 0x8, &(0x7f00000053c0)=""/221, 0xdd}, 0x3f}, {{&(0x7f00000054c0)=@ethernet, 0x80, &(0x7f0000006580)=[{&(0x7f0000005540)=""/40, 0x28}, {&(0x7f0000005580)=""/4096, 0x1000}], 0x2, &(0x7f00000065c0)=""/185, 0xb9}, 0x10001}], 0x6, 0x1, &(0x7f0000006800)={0x77359400}) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:07 executing program 4: io_setup(0x9, &(0x7f00000000c0)=0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x1f}]) shutdown(r1, 0x0) sendmsg(r1, 0x0, 0x90) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) keyctl$set_reqkey_keyring(0xe, 0x4) r2 = add_key$keyring(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000140)='user\x00', r2) [ 344.217872][T30427] loop2: detected capacity change from 0 to 264192 [ 344.280664][T30427] loop2: p1 p2 p3 p4 [ 344.284997][T30427] loop2: p1 size 78398975 extends beyond EOD, truncated [ 344.316759][T30427] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 344.325990][T30427] loop2: p3 start 2127165541 is beyond EOD, truncated [ 344.332809][T30427] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:07 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:07 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:03:07 executing program 2: syz_read_part_table(0x2002000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:07 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:07 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)=@nfc_llcp={0x27, 0x1, 0x0, 0x0, 0x1, 0x1, "711dbb67c93beb1ef305381e6ca8c49bd20e60e1824248097f7fcd8e3f4548fe008b97bba8ec2dde2253e770df884a3cc39b6f573fe1e9b976d3e0fec4a130", 0x34}, 0x80, &(0x7f0000000000)=[{&(0x7f00000001c0)="1be22778db2734534c8af196dc5bbf4856d6f61842762f4358e4a8acaa3e795b70576a97c69e3ea8cbfe7ddf6fb6be3263b815f635b6b1b0b21f9f712a272148d18d65b4201998113f8429e6de0734f423b25ebe865a4af4ff5f63400dece04e3d44db9b6f559fcba41252bd2aa640227b34d6542f5d76e495e77db3fc40e714dae2b5cce6378841880f46c22cbb97090261881ec22859d6d793b4d4ba8833c6e79afdc39b57189dae42da0bd7e866e8e2d59cb4b299c4120fed7210ccd3928e1d4f69bd5c58e70361b9e2923caa99397787a17def13ab0849865096a237135967bcf8a67c95e271079a33ee8dc19c0c41720efc96ec8f24c4094ecabf327c3c4d262e3af0d5fa89df7d0f59875f7e9058dd850928ae15fa98fd85e19eb4a9fe8ba5d08f5beb88a12bffa2df1e595e02a00dabe6a9e5164dafeede96fbccb7c1be64601d1fdd7132bd0d9901d6b4a69322d885b6c8d83b66668d47a037d3d9ef8ad716c52e3d2a80ab87310927c908c8d58b32baa49b78d4a7143d617057faaf5251b02fe7c85b7e9321aa46e2e99ef940ab797889c1f72a8ea7defa05fab21a578f258b5c520f74d40716f8de56b727f8e683d14edd89420e0c4c0dae9065b33254061a272621777a375ea557e4f4b667a8442e707203fd5ad7ea6817224d463cf86116a351f6ad0a0a157b07166f22f356c1c10f7735664d505693664cda14cf5fcfb7a5c334971b946c8c1da22c0bccde77813c61f2b5f1a8b8fa777b64b7aec58649a5fabd75db1a3fcdea1d33778ccaeb198e5c77205cd3ebcfbe41ac45737f95f6236c8086a4eecfc74f719f98c0820691030415f1c55a1c098fa02cc176495161ddfc2c87f1572423fcf71c30c681f0593b5d8083655333db48a12478203f22f959e34343d224f4ad172e8a5d686748e6e599780e9d3392d46d03317086a560999121d336aeb78dbc0239eed6cdb64dace6a6470ed3384824e5bfa5f56cd381f326eea82e5560c977b4eeb2e1e809a936789d0bb75ff8eb5ae53ff9cf991d742b66f8b48b0da0991724af2b4fa7c417243efd27ce40bedfcf043bdd57bcf0195d192814e4a9285b2e7bcd35bce96c1482516ad543848da4385fb030495b369bd3da2465546ed33bf5a511b5dc3e5042755d500306fc2cb1e105fd769b33847167ae71cd7fba90c179915a4eeeb7817c2ce2b290448ff2b98ef9cbaeecbfeebdf666fd8df56fd5b4a3680e30859efb53790ff3f6c4847638c2d8a6f5a7d596104c44c4feab8208325235a6a4c586cc26cbde7030f231b1bbef79cff048c2c88468c357cb361b36346989139754490c5c2872cd8839c3f557c590db2878aee47b7be91027f29605426feded887a809e8e268e9ec2504292c239ceae9d0432993891fed41c9ed80a3ece438438397b1295fded5d224232eb9b9f11d6ca83decc5073774e71fcd557b7be25bc62d63d3fc1673aa36a22f0f53509bee1816811f0873ba872e1507be232fc1d546698f2a0640c46dd22bf2b593c5317f257f1d5a067e6c654fe0d1111a7b9f875206af1f54680dee4d81bcf112428c66b6f1d4d873921ef164aabd8fb7fd63126d77aca3670fa5859b37f9d27d02b1ecdc5df4b2545f874cc69d2dec34422df0c1d8272c0af9fa8bce45b7e6ed8f194e1ec17441bc24a385ef6d4e100780a611868b1cbc959886cd94991913840c409b6d50d9d9a6d3a259e547991e81954bcad0ceef99e3db7d969948d46cae08a111266a8baa298e809d1e295753640da68580c056c7b7f1e2a77e2bad16bdfacd275f4bfdfdbac271fc093d0f9c0a89dd800ad97392c793619be5d45351d7b9d7dcab1cfa9be32e856e2d1bf83ba6ceaf871c26971ba27ffd9b42a4148673d183b172300b567cbca05fa693060c57060024341ffb6ecc5a6e3ee223eccf0e1acf4d6ccdc5a0b525fa8f3c981432a3f9ff5fb28598a62098b8bc45ace397d34de86617032b0660a4a1ebdad2153d81d753dd4a9032f8e9aa34977d366fe8fa5492056a75006e3285e10763b9feb40e7694be2d0a499c047a5fdc9a385c79a8f72d60f05279f88c0c086faceb86745dba9d23a3b7409f0147d2d1c63d9efcaabf1fab254e2850aeb827bd7141695791c1531b5d7ec75e16e765839c413463026b9a959a1cfcef1e34376f5aefef105d468c069c93dcb3b031ef4a7fa57c65185397901795b7bb5a8624741b0f34a778d698a0545316d38e5c0871832135245f33b989576f503aa4b26d3f652024c8736819c74519e134b65b827283c9c1bfc658237cdc620cc065f3cf454ebf89684ae076857ac091c1c728c021316b9777934fe817663394a119db2fe6d14d6b06b795232edfa62d214735128417dd97b8f2b356795c57fa4977461f74784e578a6499ebf40c099454d630742e8910ab00f68aed5bb001d2cd3e236bc47757c814670c098ad8ad05e1082181939796ce03771fa76971a87994fe9884996ee419d33ec8bfd1734c7a335a9943e603393846d6ab1f71ecd1b07372ba7d54f0ea514bf3a88d2120a6c98287a4f1cbf873f3631c9de1e967767d8387529bd49208b3fdfa642e685f072fab96c81cbdbcef7bd2b019f7bf1ae00d40621ee9269aea74a921f5c94a59be27083c9769db6b0236e2b3408f691343179bf728479baf9365dc4993e82e464ff4d453d79fb529a201611212cd21a2656c84f04c96ed4d39973e3632c7044e0d5f47110776628af5d3ded83b56956edafc99edf784b9171de9eebf02e78a9947b6b693d5750198651d659533d758b1d1ba498ac0cfb0b69d535f0af5ea9fd148a80365e6efb1615aef9b625f72208e03b37685aa1d6c75bcc44fdadaece209b4a1534f232001dfdedd1427d0de1a4683baacb93ba0a7aff1ed46cd7b694c7c366dc4fdc287078d5d53fa4311198d83aaaf559e80049eb78ee8412da9b195a0a8157edb5a34520220f55ead0a0f53b67757de53be859e0f26470da41335552dd23e1437d7a28567df5d7714cc9b535746ad454c63f6b4cb4a2294293f472c0ceff6c7dde672b7311bf88e2fd133ffb3fe0b5f5a885bbab45e497a47bac32184c948fad0f8be1a0e826df671ffcc2e63ae47f3f97e46eb92afbe4736e202abaf500fa2e5706a1882e8dda036e27fb3ec96182cba531ac3b121cd68461bc9421953a371724af2011c5e04f6aef31d50d375f9b1ee85cdc10edc51a730858e41c6bb34faaba83e253a0d75c70331543949f3fe18a96e97a840275941ae13c4ea23dae880ed3d5a29c85af2e3d1aac7194e5ef3abe86986fe6f5571cb064cabf22a898ba7771023ac3575826f50d513334e1a3d04175ff3a3362bf434275cdb829020baa27797a488c7476d2da8c3851226de55b0deb52c936fb91b412f91fdcbfa20d924ea3e3fff38bebd4f321b18aea28a738e2a69bb04cff519e2e25e4982f6e3a9a227774618aa3030f9943f69de118219ab09ca2f5904832b8ffc3b3a15ec9aa6748b5359b1fdd9927187c65b15eeb6ec06db2d0c19abf8b517341f10c603e17a6c044a083465b282ef7b133d6bb785e893ce09283f3aa39c4b3975f75b5e22bd0ac954f848c6e2bb39e2972aed1cc34512f23051553313ec34c9eabbed8100ba91ee1e60300d6d8cfe75856c86cbee146351bcee00c72ba9fde9bc4aa861f6525982d82af8494ee0d42a787d39f5ddf01151848c996909c56d3a4db72cf7ef7d8c274751d37213402c15057722064acd63de184f447ab49e3a991200014894a3537365ccb9f0c3b35e62392f7166a98667b4fedce77e110fdaf8f3b0c956b8094ee86ecbcd35b553c6fce1a1f00a5ec1fd50ad15453ee13de51cc99487b04fa65172bc4f8728520a405c978e916c89dff2d8821814fc106dcba0def26805e58ec9ed4de43d359476e4f8681ec4c40f40c4e45ff4cc92bf2cca9a4e34b224f070c99c8c1336b198aa0e4af5a45af9a626b67910409af87529f21be532da4d2c663a836c48e43e00c4231739aea883992d64f508e21151cac5d30a3ed785ea6f6f96ae43bdfa6edc1258f0f70d2e2e5ba830ef40a929d4aae62169a8ba43e52ad8abb98fb9b696dec0c89e8e770120f5f816eaceefa1facb54fe4fd9ffab0cfedbbaa1384217af7da86fe5602b4e604c309bbd0a642c0f628eb9ab0e2b4a0af2510d77d8ab026cf07060a00c26fed383cc10aeec0201f939f97b23c8744210b50139950525ec9cac0ee6a891dbbb6615f07506af5faf4043a329e25a5388c235aeca21087140c3b95f9fd6c98d94e27963b933a852a4225f87693331fb15b86da1684c2a689f0cd3b8c109f42c46443eab8a83bbd527c9ed289649851b80f5a01ab219d2c23e648af6b1b8770b2191292341678f75f4dce327f84227ffa299fdf521befd4d47d3e4ba40f6479a9f0bc2f32d9fd682f8adfb275bcee8526b40db667195e799600c8fd4c8b88495d7073a4dcaec1ad4fcda83138ab35a7bf801db87e6354afefd1f87c9ca73ac60bb9921522d678f391943596b921c20189d34c295b363d802bd6af036a932284821280b03a291f472140c226daaae67392ede511ff35800bf841539660e80aaea7a8cee28df51e45990912ad697f8a8a32450096973dac3694072f392056301dbca32589d63c90dffef61d38448839782d44cfbb85c27ff7588697616745ae53205747a5b0205517f97803ab8c58a9e8bdc95ea802e36c3330d79c43d853dd826781ad592f33431e7ce4ec2469790aaef01072ff3008f4bccbb9953d8206060fcb3b1dac2e981a3c9e00700af449f2b09cf8f7c9c8fa9b31d44814809724163434c117791ef91d67281e53671f0bdfb5ed3037d64d137350f12fd9eb62ac461f30f813f407cef176c50c7e56ac4095b324b1af8b800711589a7f565a25c89294e36f8ed0385040d01d7585111a051ec6c2d4bf0b6cd324bbb18f2dcfafc3915685a14d667fab237b2ba5f7a27a5e87045e7795898ca0793fbf90e498acc0823f7136080a5268e3eef68b301bd4d139e5bd6bc8356154c64105cefd2342454ba866658190c673829f16ec262f13a4ccf2742ca75b3f0073b3e1c438f2151676659f1f2966f96cd867273411cfe1fdf8160f8bdc99fc40ba572bb77ae622d611e4fc18a7ad936b8e1ffff0b10bd1b526b76a52153330f13ea42c6b3bfc1b948bb714e0e3b07104b8edad721b9ee42f76cf438fc2c29abb25414d71cdbf83a67c91cf00c26bedc60bd29ebf625970852c4048d0d8650ff7a3c6f30357236511ba3ea3e1e1e1647e6f40e27931cb16144db949f025f6e996cad7d1e673d29ca24e7c3735799cb92e8073895ac0657be46b51d7a35acccad45b134c2321944ab52592bdf08db86005940bd4f4279dba6fc10c12bd60644090e90ec5a68f9aaef655bcf73e1c025e809be782c7f4d8cd29b8dd964b7780c5467e7be1698286171d53739b430f35505d450cbdf371a272a0a0a8aba0b6c1a3a5a26d6e576e3226121ab5b93414b2d58d1fb94e49f0be6f5b4e3e29ccd42c6f1362e7a5975219507f09460eb2f7c6548608381c3016c754c57c49817389e593de37e8c44ab5f3f1c1b1de51f0e8f2f5dddaa2253a9536388e556ca24100f374e182d68b33fde4607694f87b667d06fe2a3341c6630e4b6c58c156379baaaadcffb04389f7f9c8f02d48827a616943ef07fdf3f5254e92de7b583cac6e0cc6af2c7e71a363462212c1049c49ea97619bbb4a201fcb79ced4e0684a446d7c0ebf725d2f8a2a4e4d664d03a47ba18d98", 0x1000}, {&(0x7f00000011c0)="06844ab7a9a0ccbd1891b74989d5823c4d76af97a49c5f7f3d7fe4b2f62be9c1a920d80cfde59f22b2eb31cd9cd6ca9d049da28c1e62f4df11dfb3aa0929879499f89e72430360f7d820816975069cce25884b6c3204bb04b5a4aa5c9a9ff2b378", 0x61}, {&(0x7f0000001240)="66be1c727e73b60e36c6c739eafc54222cddcb2b1c68aad982526c465f1dd61997f1ead7c0692d8ae533b035055aa021b80c4a72528449ef935e030182c73d3fce9a862eff4a9199aef83cce60ac016029e0f710d6371a4b1cae94ec5eb6a595def866fd8c113d2304fe15484b64c2e4d1395a0d273c6edaf98cbaff1c3105bdb6a83e014d6c2150a6583e813e2476eedfdf8e1e0c2b254ee08c2eb240a8bcf56562b4064d95a097772e7f5832edf71d544bef49f44e0a5403b756f6c6a73715128907b057e1", 0xc6}], 0x3, &(0x7f0000001340)=[{0x20, 0x116, 0x0, "31e0a378e92da16ad671"}, {0x50, 0x1, 0x7, "18eb991296593f87392039591cee173d84c8f6a28450ec7d243a5bbc999a001b2a22e01d6d94e25652de8411900dc182eb5e940cd4f7de6ef794cc7e74d6bc"}, {0xc0, 0x101, 0x80, "0c9f91f57de060725269834e4a5e91135b889b1e59755fa6c1eaa6191957904da4cd3db24258ed340175ea91c3c9b5ef5d409149c000dffae67cb1a86c99879fa9454f7cfa2f19e1d9b76e86faf91d608ec7af683d624fdb0f918a502eea1d2d3c377db3e9284ed08c8048a232c25a37a1e555a7d6cf2adf3d723c37a285e593aa3780aeffe3867e2c724e583b8afbd0a32bf5635ad0042f36c89929ed5a27d38ea4fa41783b4c3814"}, {0x88, 0x109, 0x6, "4d1f86a89fff9a609c4713a69491c97b935cd8ce6cfb191ba4f730daedf771ada661c65a4b32f0fbff8321c099dbfa187fb311550ba2c78e6cef53377ea6c47c3e8e1ec129311171996b8c5a89ab90538a66289504bc8ed15429cf0da0a1e5c0125ff3e7fc4077f2cfbb7d624c18102d467af3155159"}, {0x58, 0x109, 0x8, "f3c0791fb56eeb713fb3efa7801a79a93c2243534b40469a88c2038a71776aae7c07df62c916de120ea7b20667d3e04cf857d0c052dc9158c88ffc85a45b3c810f"}, {0x68, 0x118, 0x76, "47771c70f3f37dbfcc9b28e1cd807d4c913648bdd203e29cc777d7103d0cc455ddca68643e545dbe2f52f99fe6a40266d5db101b911f948ab953cc92c825f0cf5527809b9cff13d75240421d91ac755b9ade"}], 0x278}, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 344.884276][T30417] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 344.892850][T30417] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 344.919715][T30417] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 344.928249][T30417] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:07 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:03:07 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) tkill(r0, 0x20) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 344.993033][T30502] loop2: detected capacity change from 0 to 264192 [ 345.025420][T30502] loop2: p1 p2 p3 p4 [ 345.029559][T30502] loop2: p1 size 78398975 extends beyond EOD, truncated 11:03:08 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r3) [ 345.038007][T30502] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 345.046507][T30502] loop2: p3 start 2127165541 is beyond EOD, truncated [ 345.048087][T30494] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 345.053295][T30502] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 345.061759][T30494] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:08 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) keyctl$set_reqkey_keyring(0xe, 0x1) 11:03:08 executing program 0: io_setup(0x9, &(0x7f00000000c0)=0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x1f}]) shutdown(r1, 0x0) sendmsg(r1, 0x0, 0x90) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) keyctl$set_reqkey_keyring(0xe, 0x4) r2 = add_key$keyring(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000140)='user\x00', r2) 11:03:08 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 345.109221][T30494] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 345.117752][T30494] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 345.146636][T30502] loop2: detected capacity change from 0 to 264192 [ 345.196891][T30502] loop2: p1 p2 p3 p4 [ 345.217431][T30502] loop2: p1 size 78398975 extends beyond EOD, truncated [ 345.242583][T30502] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:03:08 executing program 4: setregid(0x0, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000003180)={0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000031c0)={{{@in=@local, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@remote}}, &(0x7f00000032c0)=0xe8) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x34) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r2, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000003300)='./file0\x00', &(0x7f0000003340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x100) r4 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000033c0)='/proc/self/attr/keycreate\x00', 0x2, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000003400)='attr/fscreate\x00') r6 = syz_io_uring_setup(0x3177, &(0x7f0000000040), &(0x7f0000000000/0x8000)=nil, &(0x7f0000006000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) io_uring_enter(r6, 0x0, 0x1b90, 0x3, &(0x7f00000000c0)={[0x3]}, 0x8) io_uring_enter(r6, 0x6d41, 0x0, 0x0, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000003580)={&(0x7f0000000000)=@proc={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc, &(0x7f0000002fc0)=[{&(0x7f0000000080)={0x3c, 0x13, 0x10, 0x70bd28, 0x25dfdbfd, "", [@nested={0x2c, 0x49, 0x0, 0x1, [@generic="69a353cf8034e010a57e49d50a961d7a10ef5c5309eaf2d7a21f0d6d686e3c7f", @typed={0x8, 0x2f, 0x0, 0x0, @pid=0xffffffffffffffff}]}]}, 0x3c}, {&(0x7f0000000240)={0x253c, 0x10, 0x0, 0x70bd27, 0x25dfdbfc, "", [@generic="8a967d4e9cb1d47d03348442703ec2164ec72044ae83e692d580fa12eba0c649e306415fba76b1a3d162644678a40abd050a87805b040866f7af874dd0bd77d8ec00ef6b1e1311048c4fb8fff0d7a13e1eacafbbc122252f1473afccec302e4860aeb6ee9130739bfcd16be81992661a4fbf3287bf31bcbc5e83eefa04f7fe8a443c4e6ec0fcdf1d00b1eeabf0eb24ee008b70e1ae5460eb65f25382492348dc4a189040", @nested={0x1089, 0x27, 0x0, 0x1, [@typed={0x8, 0x4, 0x0, 0x0, @ipv4=@broadcast}, @generic="20062913c7b0ba44bbf7e06b1d2c622aa0fc1f910daf52f931337d2694af34cc723f97d24248b84fdbb693ef779c181cea3c5e3c6dfb596ce14d71d3a3fa776849c88694c6cc2a8b8142b4c5bb14c16e4e30e206c64cf4eff02a1fe746b94ac5ed5b99c90b451d0d406a2d1f45", @typed={0x8, 0x39, 0x0, 0x0, @ipv4=@rand_addr=0x64010100}, @generic="330c84b34834a817ab6741160475596bff033848b96a25f729ac2c6b962f4f9589472ec45203f6c1f3e53ee2bc590286f65ddabdb7c081d8b55ccc0fa3ae96da18664083d384a189d491d02c8526b76b8e2ef23d1979f4d9f37b744a4db9d3cbba497871f415eb7b31caad50c0e99e46439ab5627997da04bb8774cc9b6f1b3ce5af87f8ff7031be110811f4635a1b99938949b9b64deb1078f4de4b9b917928300f1cd49824c7a14ac21e77c9dc4080782e7e39fefebe474e1421589d5f153b008bf16db2f29061263b0d63a3d955b099a6fd6a1ff90cb623c46a3a5e9779e44e5c16b5a848f9da1cf68a65c6b72e5c9719e05bb3a67e171fff41455a25eb37c6b5533a0fe71812add8df39ea4013a99ae376a7fccfbb3c2c966852c56562c496a48dcfc60707d7cba7af60efd89f8e57a095f5e496b279a786bbbeddce44a34d4041e1fe167bf789582d2e74e9273be4d66b4a0a54dfa5923a887fb3d3f675e3661bf22c859707eaf708c3034da9ab6df8682420b0d60ea061df20008cd5ce748bfa641968290b77568345378389ada3fffe462a862f637ace6694e25d5e12981ecd8508250de7f095f58f394781654d1f0fa74579d21b02352710cb4b2664c8547997c93ea5e7e6888af76c0e104a0ed7c59bb42dab8af37d6a4dd1c4e07fc36056b8afdbf1ed2241f1cd65ff9499765b0c69afd97c7701b1a6be3239f7c62eda6299aa8e5d1106969c5a6244624a7333b0ada6f03489e650d357a133089a3d60afa1337d126f01e8ab2ac0139544cb5df082beb63226be1260fa26dd33395763e6b2022501df99ed2a73e7b9638c5d5ae78dff368ea09809b85b2fb7625a476889b37fb26b8a0dd3508df50d3ef6781baed45c527cc1b317629ef252e333f29bbdba281671caf4de439b7a0313cb2c4f49b2249a41de67446626f4ce5da113e383d2cacc1003f44afaebba9ac8ed418a5be7fefcfe006264e043490d123baec59004bd31f404e6af86e7fa699169fe7eb7f32ea443606e5a542566874bf5f995cfc40be5ecbd920472cda8ed5e73080d1a0d059aeb69e1008c8d5ede27c5a89230a48d777bc6392028709b72b96ff5ad14609769d5ac2628ef39b9777f62d565a1639f37525ac5f3b47631f6e3a1413bcbce9b3f3435346c220ac139f7e4a1e11299cbb8914f1c487826b15439cb5338bf9959813c20dfdb338499d3f02a41b095f67418493b797842a29b4360fc3dbe1085833bee9821752516f257d1d59a05ea75dc632948686377527692e03bd38890a150db901951af9d2069bea6600c6d3047c99f92ca379573da101b0941787f2e8d26a972a23e7dcaaebfb10fac535c7c876c9604e9f76b28e390f2b87f3416eab0b494409465c5d08773cf3806f5f9e2d05c58b0bbb7f2a08ca8ef34eef5f7dcf94b3a48668cf999552b0700f692d69222321281dcfed690c5d4e04375e4b73a761e60927efc6031f4bbc2d782c36e44de9f3c50bb34b0205b48c9c28e399b0055914bc146d82f41853a1176a70297f37aa98c2c57762639870956d26e40ad4ac272472f9200c307aa60a81a68a6b5d16a27b69243b77b3595c9fb1d635ef25d3ce7a8a2308c4ccfe3d5a4dd9e5dec5f440395aaf080cda0e629889c9c328a88a92c0e8ae85ac85d9d30aacb389fb93a93c652ba2a067b2384dacd4a03bbf3fa2f7e57402ad3eff0a391727651aa0232ad4092347f768f0bc0bbfda787c70231d9dae857b8015a091a357426aa1af2d012c7265f3573a9604a8a869b64553eac076b9d3618ff1d19955b069148d178caa6c65c3e3db186e553eff3f44181edbd911e3113e440df19d9d2e71cf13a74bbf7a81264782d82482b5d4d2bd5007a627383e39dbf1689d686e294bfbb2308600b3b7d09544a4bfde97398857eb41da5f81595f50e5703b39766311b7a007052d839ee0e69b22933a31d1a170f15ba1669d3fd63b96ba7b5ef0d485df2c8ff55fd733a03672340c201dab9451ed928bbfb8338cbdf5ca3d76120216c3e7e45235362bd5da631d3ef0ff269751f705f539414037299053affbc57caf88cb450ea6e47c893b9a216918ce7f16fb40fbb87b6e82e2b56f59ca5fe178dd3418db2770d3d0431bf1b79ad80ac16aff932ab9421ed573fb0e511caca0930e6a7d1868676a7fd686dad73f72ab065480ac7ff06f05038ff7dba7c34a405ff9f479efe752928231b0a4f69c2aacc8b6651082425708ce9a7ca3efe09bbfa955421cfe34bbecb339e54b1b7167f761782b4b30002ab4684e3954de4a028f0738f1854473fd80b9671f4e5e8c98878a9a6ff323ae77038cc6c0acae41def65f49ddb7e5a98b6a524b9986a8b03feb8cfd7968dc955e6493580dc9764c6fd13516048b6cda36587b08f4205952ae1b7f28facebc907969a92505e6a397d4fb70cd11cd442c97a4ba7462a153bd0c8b7742e577e128dd117e9f8200572f96730c48fcca16fff8b4c931eab239582ce86b42905cc165ca31cc7ec8c877917dd2a784e4eb36d3e5b73a881462c0895a4985434a19bcbb605cee7283c5c9e17899d27b6f30cfaac468385b8750cc63cf0a2ac876749cfd7501280db1c655983f81ef2358143d937ec96eb1e1b739f49944296f9aa607ceab65c014b9e72cb4c7285085f542d7da6c90885c1951b3338901ce4b4100512d95e091e7bb2d4ffc19b6f949be174ed3290839d459a8d120f7b3c91ca9e55e0cd1b9943e3cf224012e692788bfb9feed49063528acb27944e399699cf15655cc5b8fb7dbfe745b92d9112d36d8f1d3ea14185a8fb03889ddc9a6acf1ce7d6ebab9d78ae60b2d2ca2add111467f756d410010c1a511b61c874d42175e369f55c6a83c417727b4ffbf7a2f0f3f2a84af069be617a6e1e5f77880947a097bfad0601535ee64287812cc4ed6e90e1e9f2853afdcd62a0ca52ee2afe7b0cdbc6ae94b09574aedbad12b2c4547d75ee151ac1dd1554433ff79513d9300fceec672dd7fb2443d69c032c3d6953c4293ecb30e7f291b4c46ff9116af5fdd7ce132653336ef70107027c1150d73d8fbc2c520f7b3b01812529cb1c96a98d26d6e5a405995dbf792a67839897cd0a1091b39a81a19f984f3797948638c089fd142c3efba2991b1547e7d7afc7bd3ead26b1245ca534d14f6d72a4cf0e41a53ab9d29fca05aeda0df1b3c6e7a68c428f07aa9a416fa151c13146ca3dd5c8e3ade8abf5c0acba59368cf6e88028c5872582be993698c2f234535a78107adcaf957fa0de7152870451b2d9d857dcc7401619bc6c0177814dfaa51157c251f57c629ce75ffb805751e7c582a53d4c565ac20ad87c35ae20fc28935afe4295814a08a77bbb2b7665f9dd40d0c770acf003a95e1da0d56c326ecdc51dc80cc2e201a8f9cbd996e6ecc178dd00cc9729f392248dc11f200079f17cb97c0f424d417aea16247522e7cb4e815d428f249f8fc8805c58287d3d85f4aa9846db22e22b10a10a3b13166b57fb9a9ad60a60d3aa45925d685abca26ba1a0d6dc030be757da236137b73635033ef0ca2046a390aab139d69a478dfd953177528b40d8f721c9d359a5007b0e8b3b94a401680a50bb5b5b39e34be3953c1eacc1581e7dce625c20f59723f6fc50bd6ff33aa0323e0bef82030fbe1c13930cad4db561763477311032009357ad15f9fb5a57e322ec2e0691ca943e340c81636c39e1e46db12177d0a674cdd9a031e4149b0ea9fa3a38713efb4fc6ab9435c6744c5f2f3ef9b637a4411dcaa7d7bf91550f4d9ef4d1af509289e2bd5ed1e4b92318a853bbc1276e9fff546fb4d195eea058678fc106a1beefd82b3e37fffc1f91c154d8a2fdd09e966dc485007861c9ca479c72198c35f039dfd56bfa09fd0cbf0a94e87455d08214a584bc8d2a996da9a253ee53e225e7964fb446327236856319963cdd4c1ed1871f7aa0e0ebbc0f5cdfd624d7a601325a86f327a11ba7da732c3988a1cad9b96f8877dfed7db05166939907e53b0d0f82d21af3c82acda02ae2970aaf73e345a855a3dac3caeea1fd60139d0702760639bacd4102f9fed62b422495b8eacfdcef3cbf54eaee65b8f06322620c333946f98e40aa669b9265376e131f23d6e9cdf0ded9c118329987784d25b60c053acc5160ad1f422824ba3666670fefea4d11ed7ae9dd3db523cc7ea6bee59f111bea79777c891dd4cdbe81fb57aa244351aa666a9357b59cf8da606288c585930079fdb30d99f132e72f8fe70fa834fb8edde904b86c52e6ca75eac0d62b1168e8f40fd5c4a5bc071b162725b2963c955c0ffebac5d62dfec0b8e2a6a9badb6d159f2edf47f7dd66df67a7a2baf80702b6a23c969a0993f916427549369a5b4c106c17d8e23381591f50284297a4ef3d153071b9895129cc68be6b4a283b9a5a251d1b439c30d758fc66f389a1ec9429cc4a5fdfbb49508e34937b2cab2fe574452b15d388a3e9270d127948819f316f8f5a3c91b136a7b7580159720f455e2ec56bd1ff9cf5d5ac3e46d42eaf9bea84374aff51f405cd572220148e4a89fc1ef1dedb81b91de9bf199005608a2c97c089ec90ee4555294fb8e25990a451e45cb490a5b6313febea636d27bf92c7bf3bcba4ba1b7eb470b1c43d3edc860479e44c2067cbc2173e36a0ee8e921391ed38d787f46344787652f5bc6e8eb4749dde534ce72af9fcd52a1e5279377e4bb7ac0cab0cf26548703f2faaae4315d3853cf2ef82120195139006d64c0931abef2bce24119b95705d1ac6c8f37c31eb871425ab7f25ffbcc36051ccd701860687b92cad3c96e37c1c94685845c9ad7892955b27d153065c64f868a7bfb5b44dfabf2eb5b38db27621997973a6125067da3e7e112c56857a60755782e3f07cbeb941746ec074da60c0c44d3ca7e8cbb79e618a7005cc93f7fecb2e4e6239230374ccfae11b9bd6a40c4f7809f427c2975fd007837ad099acf0bbb4ef516db0c827cd29a56e7e7849728572dcbb4c769ecdf9081c05683ac1dd946bfaa4a6ec75eec7f63a9b50a900cd61031e954d78b3a3092251ff70ed624c431177b7c538d8b7ef88bab77b81ae98ce047eb402fc04deb826095f198c577a586ebf91beeb4acf131adcf43a7f547cde06f09723354313d81fdefad64052777931eeeea6126d80e424236645fc2dba8418347280bb62739d585a8d848ec1e3fbfc0ffa00c2b47b483898bd6b5d99567b3addf1f54f0f9a0b2b468e96c034cf40eaa2b63db640a5ef6fefcbb5a7ae47c933c2cc0c2b1718df5f90b25ca5b2b8bc2a41c548d45fe06babea50c016e485335faa7a0e690978baf710b4a43ebfcb1962f15276c7f306ee2a43142c06406348bd0e6160b30ef7ed38faa50b744ef6b0cb460a6ae861230543076df96e081800b48088ee2fe893e0a6d2bb546e93bfe6f2087e1f790f732cf5b33f45c517b105256b085c161c356b7f2d70e8bb6d99fb3c2b3e47cabb3fa95de124ddcefc083f95ad9c18c3652e1b3482a7b652be8a1ccc9582abb5227bea5f14423f4eb6a56c36a07ca31ab04bd3300c4d6041d257d8d6916bf1cc730e8048644df2ccfe0013a5ab530fd447f16e38baabbf01702a5c5286e723a13f3b68303de123061e4f9609de1ee7283e54ca9bef15ca726b0e99950bc45313b3d0458c9c2695d9c1462115700b73c066f43c927c3d561d7bdceddb1e602f5c63c9a66fab9d671a6059458d0804a2dda2328500569999a667b6bbcba1fede1e6d506b5cf96f7f6b351244ed732fd62186c2ae7548d401f06d", @typed={0x6, 0x5c, 0x0, 0x0, @str='.\x00'}]}, @generic="6f83d8f1b6d366f477d9b8243ee95e11edace8322df20bd8f778b5e697b548c663495f9eab91733a3953888db12d2555cfd351b61f1f8e3b61e2fa5e582b9e3b5f842fa19bfab6e4ed66b57cd19fd38ee887cf0fd9a15c578b9468f6ab2b3489a87ed94947566ed237693f59a35b0c4a2cf52b137d4e304deaaa1c66b4175b472a1322757d988084f8843154a82279ed023412f82cf026cd088c7fb58751299f1920b457bdbc43300f70cd283caf2dd4", @typed={0x8, 0x68, 0x0, 0x0, @uid}, @nested={0x1bc, 0x34, 0x0, 0x1, [@typed={0x8, 0x28, 0x0, 0x0, @fd}, @typed={0x8, 0x5a, 0x0, 0x0, @fd}, @generic="7d6aeb19c5493f583bdb209bffe9d48e7f23ac4841043d405a719a54c030e98788c0f87da36c77a26982dea1749937c1f60846f8e483042e099dab4bfd03e0a8155584ef0582e24776a1a1b81eb7e463c78a0b7be43d4adc71ee81611ab4e63b0df493d853514d", @generic="25ab58ed612c8f2d9c9b9a5baa7c2f8ae37359b38b950c55095c2d141f06ee61e7983dbec1317baaed9eec3e30fffe18d0e10ce9c53031346825169fd132e1d7744c1dc139b348952bd48dae78dab97a1d5f015192dd846acf8f1497362216746d63a887e2d5a03bf2007afc5c538842c5ca85b5614afdab81eb921e7e90a26d877aa642def98e9611fcd7f787371e41372081bff1995874feb4e88b6d432583ca0a86f93734e58d560a12e1904e39705dc7", @typed={0x8, 0x11, 0x0, 0x0, @uid}, @generic="514b6bc0f1cfa163717ce5de0c7919d9a20c4a65a2e94c0e65249d2e", @generic="14c66afab894ce10030066f03d2b70730435adbbd647e4c5f106694cd1a28860c8f42995c32525c004bee38f8d411efebaacb86b10d39ee56c18a8", @typed={0x8, 0x89, 0x0, 0x0, @uid}, @typed={0x1f, 0x48, 0x0, 0x0, @binary="7e4cad0cf1593743c87e0fd7f932dad5357d54302a10a8df99fbce"}, @typed={0x8, 0x62, 0x0, 0x0, @ipv4=@broadcast}]}, @nested={0x1186, 0x58, 0x0, 0x1, [@generic="3c525a1bf79f7b2c692d9f82163eca3c9e0a6d628faf2e36b6249a7782df7ba9bb9815fc961e84c26050918d33ac427e398ba3a2658f6bc4d589ac5839e875a1d1d4aed7d3d890e90dd088d503fcdfa7e38e27c3f83e950398d67128a0a8a312e26f25cb2f32", @generic="dea15881b7c5abfd06c4b803305bd127c556806f28b0ddd5592cd8d2b6ab552bc1521676d2cb5b2883c437d1107077d2fde007d39369abb576982de7935f543be1e58a9d2d91dc24a2", @generic="9cb42caf5a8e7e8da07677ec0812bd2bb05074c9de8969b9263c9d83de756338130d433398ec872bcd8e58c8f0ffbcb1038516e6ad3b1022345c247c833bdfb02a43e6d8e7d9401cdb861034d3755549fdaa4a66b581b6fb159d20cffc79c05e99c9ee4c594b0fbc3f7da9e0ad5502852ec1972c6f5ba37e7e51794aaf905b2c9845dafc21f850a6abe4e81923a6964366dd20331669fc099c805f0eb9367caf143330adea689dc296167e6dd1aca2e082d7a12eb4a1aa2776a672e7d82b52e7745856a23649e9c9ef7125ae3fb25d18ff4754dfe7768c00d4974c9fa5c9be3d2a0a5bc15de7f94aea7093701a093d773243d77116c2c4a0c110763e48d315bfacade0e900e0f880ebfb8b9af1a577987215007d3578f16f5c7ebe320fe7656e976e98cba0701c2b2cad0620eec5a85630027c0a113afce7d8209fd3972ccd3ae1f5d1b84dd99cd621f66a05ee748bf752c7c73c68b8f21b7c86aafb9aa32697167027db87f2a0c9740c286d67b8ccfcc7b4483bfa663d68f3824527f0854f345f03f61580a086b4265deb74182064b743906069c24295ea7022e6d923c7bd61a45616e92ce48bec0a02bcb169d52d1c2b409c5e4d6d7fdb8dd3b488da343c520fb88ec5c82c238aa220610bfcd4c2706b36b8a733c37c960c6eaab151e218ec83c31cdd8b3faf74767569204d7c9c96ce13182b4a32eaf62a92532297de017c0c36dbade23f636d43d3f3e564130248533ff6be8b5962af4597f8925fa9a9a7f4433cc6d3b6e81a203a53175ee8b91c19ed9a5a1eb6e6eff687d68ae52596b8c7a7d479ea190d905084d6166cc51460993630b29ed876ca67fd1a0dcfbad228ac7e7721cbe7469292f372b20d58cfd7e88b390664f1acc705128f06e3cbf1df090ae8e02782920bf74c4b3627ac3652ba76e9a45091c2bb114bda6fb0f8d08ffa29694842035e70708057b94e7810bb0ceebdcc6be3dfa18a2ad2b92b2933c6e51a8cf6aa5d29bf5836b462deddb96a14a6e4fe216caaa1dc1c6a109b58005ab64533d99f846a287af487ce57e7267ec9a4f6334687494bf4d5842357ca2cb1cafec10294e7f5810ca9ff24cf3abf8453ae64904e8d67d913b6bacb11b7fa76a0aae12d07742251206a453844bcc2a8ee4822243c5fb7bcb26cd9f9e11c26e42674aef7411701d15f8af8f093239cc9fc9f18ea3cafb9cea1c7c21ee98185c10e79203192965862c5f3980bb34753443dadfbac9abd57a3115025829a72c666468056d976811cd9740c327dcc8b2221e18514f91b24696b2b9720e363f4e718488b2e377ded67e4b17c51c8e33cf02257c266d101341edaf61b7bf25d7510272c33c944bf0cad54adb2983a71f725fb7b2d55875ce7c51d429e5ea4e72d12196d0abb659ea720d1ffc7918331000f43eb16aff51c356eda4b61ceab951549cad5e08d2317d174534eb187edf884e658f1665c0f6f13c28255c031da590b8cce3ce2732dbd72180af975c1b7a0d32866ad595214f0840b2ebfcb1c961a5da9466c0b25ae64ebd32d321b8d26767db3f4f83ea0f82a2c0d2b63b3ad90cf959fa9ffd84dfb299f1cfda194ac2732ebc9d8000538ab8af4469ef9be85f7b55cee48887a73cf6382d777dd6568846a548fdf53e0db74905d7012604b9718a36244eac8b5feff1228b4baef01ad8ca87854814e793ecd10f4b7cfe2cc892183b6649ca1cee332b947c6b0ce69cd894a2c4cf8b265392e356bd3b3673db97c0562d72e05630e7d09eff2bc6a8dd585511d80cc8f57af0cf66162311dd937427b01900a6d545ef1f87aa5df5ba31a1d24a6d055b992adf907f772fe7e216ab2172c4bcc727e5c066c99d21bb909220fb71376a07521e195996814f42664865d0fa02edeabe033f2985bac8523479a737e41dc73ea633e6c36ae37c803b73ee4f1a32f7df3b94134df20ad1ad563d87cca8e19f25764699c89917930b45b60bede2c626a83e1323f20ac4667093ff6cab47705dd90ab9eaf2e1a3f89e4b65e49a09038b55402d81c8c912fd09d593c2a3b402c4189e1a03aafccf65682b220960e2d3963fb6eaad06469577dc27ad83c68d6fba1499d7b7def10ead700f4eb68fc10929379083fafb0524448bf99ba85082883b8b41a5d29a1735a1e548a7138793836c858be8f2dfa5d4614ae6ea21a7e6b24e7ccd4265f2516559cfad795779234cdfc8882d66c06b44c20b1175bdcaa3d27c7fac706b9ee32b615ba17ae0a3dc92ce3ab31867f3cba3a13bcb8e7b75e1fe41af55ad64f280736f8e6f1f22f88c70cb1537786553eaa02867a8aa43669d7fb20e450c9b147a2a202da063d3188565d56d5cb91260ea19b73a57612019207920fc4d6f623c42bdb063325d611285dbd71e9b65a039b024871a471ddd5c7548530f4f4fb02489abd92834ae90bc0dae92b19d6ddcadaccc998eb2fd95281d8063968331934c5aa07513b48718d99571e841cbd6cdf00c687c83c687856bc8bf0e673547dcf0d2164a59356b25de84c124c6eb31a7052562e4920011719b1ceb98442968c9f21b12d28e0379025d1e208c6b6b006dfa7ebc72306c860e0a4df2d7f62c1b10cd8da67b35d6b93613f816c2d2a09440fa8e1ef21a28f9cff28bd96bc3b5a3d7de19fec58ecf3fa63b9ee2a526f544ccfcacde6929b010e17d5591dc54301718d4db1a980a7e43cbc62b4a46d9f4057354b1abe5c0cfd16f544fef7d277b6602b8e2296c2d72bd422a1c1e53ef0f7c88f7e70b0fe4ecd98545204d0a7d5272290b1d2ca4b28e255ce79f6d278ea3628db22f6b492f65bc7b39adacd41908272665b53fc7df44bedb87fe4428a1b9a7239e10c121190321326059f35af2fba6c9af93f4f6b7e9bb219e7f44144e94b7109613cf102fecf81ed9e148d9c2e0feec93c49acb0fb41972547ea32b4f2ec67f009792fefa2b874f8fbcc845263322ef6ef92c3c718f1305cf13672a788a271615e1d22274d18f09b89c33a20478832e582020043ab13c816385e86ee7bcb8738db27b49ac78e0e79cfddd6f62695b471e6206ae1693179a14ca355a5481a6e774299d15a9802c1e6f98a7b9e35a5f94568022f7873ba0853bf71e2a204fe369de6c936527abee3324186dbdb99c747f096b56997f040fc201c5eb5241f5b7d603ab35944d5cd19bea67417b6c8b3e8707dc5f88f99338c4f0af730a20d21a88108f6c6a2f3074d80bf12f4066012be3664bc12453666433b83c3111e6689bd089d42b1f4dd5b71796d6c243539e44ebaa31ecf754de8db42c8873fa6730bdac89505e197dfd49319fd4d239ae80c212c9b10ca6a3814460d4f1a50a00fd0112ebc775a00309048ede8e11de6fc05727f83c3c2b67eff76d8e89c10a9d362f8853cb04b2044c32d79e5f2e2c884076ba9ea085094d257b4df5bd7a38da72d755c5dad4470a9ca111d807922b867f9274651a94c2fc62b64006865b7a6a779b5a2275723d20810ba3011562d1efd417b183dd321224675229c216cd84a30e59612be7c470499ff58d2793924f92691e9ca11e333002912897c734ae2b6f71fe9338b3c21058db029d14e02caa7596e4d37a49fb99ecec729ee41a551e4fe29a13ca715bb6112cfbb963f546be645891a6eda678ddad7322aea6f40e50e6c62bf71b057b1c5d0149c751c95c9d029e672351c9283d5e3cd8d13fd40d73f355a460239ad225b9c4b3b4bac84ca805b7c6b0b6e0ce3d99ce2a930e1292606316d0fd3bb74c6c186ffed14ec75393eb8c12b34cee8614761dce8746317a7d5b5ebf7742319f8f34c464fb0abe02907bfd52364ef21755c62da270354f321aa5bd95b856374d09947b6c7edc4a285fe2eda5f37a4279bcee6d027f38e9744a8e985795640f16de8b154eef17af863ffe0e4577c32295eb03512a0a475cfdf6c1394092b63e33ecc03ebf98306efe9185cf1655135bbb595bf9503e94230a5cea6900c3400daf2345db1fa6b751d80eaac451a37f211adaba10ff0d7f5f5798b41c2ea542233ac63a7f0f1d05f86f6aec254d33d36a9e74af95d64a76d4c38d6f2d1677b2ce33576dc304d4c25f2463851f391abbf4cf358c2e086be0fbea2300a1984084d2000c0350d5c179c065f60ea8028b2f28bea13aa6142b59c2c1cac4a928ac139af80401cf5f6e6c287b28fe2d6189385ee84300793549ecafc8138d7d004e0dc4921a5edabc70fe471d91db0cd58de49262a4e99be8faf8ad44b596026609be8f048e092144a0de5715fc9af542e645f9085403f65344ac81e850a2c5541b52a779a077b472f211d988846663bda5bd4b01204f867eb61e8bd95919111938da9588ebda679c5153f6f4ea21021a8490722fd38a97f4e1bd74e67b1d04258d8b4391546aaf9e26a1119ee9f1c2b8dfc385634d676316d651b423dedceab875e7958ae74fa232eb2a937f492443f090c1be581033e051f8ef176d64461f23039c17aad05277d76c6137ba4e8b924885e70dbfad8f35ff8cb578215cbc2aaf1d80aa351ba2846d65e4a65fc4593bdc8a653bc85640da909f4269ac6e7ea28d95141a749217b43df0123947cdcb442db73ecc023bd8896dba9390b780b8bbfa013530fe8b04e86d37c25c312041a8c5a2e844938aabc7a89ad248d4715b5a7c9527d5783d2868e16e02bf22544e050ba30d69fd3fde2a34a83143f42e31fc2c13ecfa54a5abbbf55af046ebcc46cf14938b44427748ecd6d54ac841838278a78e83a750aaf8c9870c8133a4d479528bf8a0212ea4b584a9e5739f08602342656f1df762238c16fb47354045a99de34fdbd1a2eee6e09fe0c71e34e059a2250730ae60d19dfb5387194ab7261838a7b2a224a6e254f1517556bbb8d06e6aba378aa921c3fa2c8e53057524d30d72095e72782f1ed4a188ded43ab833cef17fb38f58a883361955af52ee66cd218db7cd3989d34000b010202eebfc6c486f5394a2993ed8058cbe4ad78af986b628bb372939f3d239211903b6fa942705c97a44d94de058a549fb3614c35d71c29ebcd3a4e4001878b66db2de0dcac2bfd15e5309679f845c0a8aab32ff5ee5cf3b177a10a65faf4e3194a6ee08450c71debcc8d3229fd25b989d8da52c60c4dc88d56eed778c0b54a14c1e339e798457a9dd6dde9029c1a6592886cbcf0c237ed3d0e812ba1f27a1a9fadd19c31ea96ecab72c1a615a8ec94e8cf134ce031f016bcca9a7b2ce345c35e035448e3132332c5e254de5c60b4d049f7816685aa2d2311389fb000c7f2b5d4364a4b9a903bfe82a7f361803065e86e473f967b9f15812e210753db0c8c7267b4e9e7a5bdb1330b0cb694124a3a278978c9156963ae7eaa7d97ba048ec574b7c3b005fac5642d0c7c8c7c36f0f84bd8e8ef86d5a6870319604ba151636997fda8a787e6fcbf0651c41f7cf6892203ce45dc51755889e03ff1581c569db5cd578354ec3a6dfae7b2528bf41a4daa4369ecc694a39655e1aa45fa127b61a7e1341286ffdf0d21027056a86b2ffc933cd82aa10f2c0ddd25ca5706b388d699fc09dc0c81fb33a657affe4d50d1eb4d35d9f55dd50beeae02ddf4aa76eb3c1d7a615523bfd0f96a18a034b3d5f03792d25ccfcc6783305bb95a856d56f046ab0d1be74fbb570bac614967297e2722ffb32588aa9f50f42a1a3280650e8f6e9f6fe67bb823e4813a37d2a22bed60f5eb41aad849955a07403caf352f010338994f3fdee384a370495a2123272ad743318e59e81a03522b9c84c3f4a40e6e243b11d9c62c9a0a12959f", @generic="d52a85c4fff2f3d78df4b9149a83255cbdb0f6952406d0349b173ade7e198a1aec0ad7f580b205fb0485a6d0869a24e52b323ee0bcd3a55c6fd614f3ed86f7dad81706b54695955ebbd6fc360cd0aaa5e86db787fa17", @generic="bb570af20afaed80abce9742a7bc0c0170572657cf5109b24ac5ce668048d5e126d20c99ce6a26d47310f6a6533ca7eacc1dc1f76e8e0c2b96a581a7934008b300c8aaf890376e6ff30aac3e9587a33f7e8ef9ea70ca93cb71a23c9f61f625db89e6e0d58cf4277ab67c02873efac79955d597f6026c1d58d1a6b94a44"]}]}, 0x253c}, {&(0x7f0000002780)={0x728, 0x10, 0x4, 0x70bd2b, 0x25dfdbfc, "", [@typed={0x43, 0x60, 0x0, 0x0, @binary="d40da958195ca7391f93c4c006a631e2b6f72bb3dbda7d4ba6ed20a739ba6f08ea1e1e9ccfe69dffc6b889fcb1451e7bd04bad44630af6c9e9d4dd0326a11c"}, @generic="2b32155e180d4dd1992c3b819db2ef3c1d45b8950388d1ef279c7290bb553ff35781d544374ae36317441e619beec5fca9466f6a3ed8a95a4524fff508385346dd79777bb4b6dfc97da2351af22ab9d93b87f7ed20314d17fa3b272ae15ad2344f34c0deee745097ebf7458d07b51ba2089e7224e5a8e9bd1b64b6bed71694becc30ca38e9beca376a12b7d4f764dc62ba9793bfed372ab5410d8f647815191167a55d0438938b8b5a04d10dc523ca967c9b75db31ddc2bc3ffb4af17d1d8e6e4483", @generic="5c9f91c5e593de43f325113c412973576566ecf30726cdf8a204fd7035848be29c55d73abda7a23a5dfc8054890e4820d9ac23dc1c62ac5ea5955f675d21656e97d1a7351040573b627fd15c3644abfd175fa3a7c3b1008090a6c7ca11ffcd3086ad2eadd79207b4c126738f6fbbb4c351d4fd4f211c13e24ef3c1002eed40f0d9fd8f857862dfb1dcddafb6b38e6a683aaebaa295a9ea6188c0189512832efaf1dcf30067f3af24", @nested={0x291, 0xf, 0x0, 0x1, [@generic="1896c5ddcfaf7227a478f6987cb4f9f26f652a8425585f6a9ff203d6d2b729f10bdd23ad7a4aa0844c86b554b65cc637e1d8b3100b0b5521c4676d07fdc8", @generic="4d0e7d4c5bab6dd6fa2a6ec5a1a85687b19d8791de14b34acd6a8a933550c60b7b61956582eeecab9117c06a5ad18444c5addf173da1262919b3be9100a068629c75b085811e41e98359a1a3b39a804bcee65bb1234ac914fbeb4a859a4e27cc74e44d01947bdc799655d76fbe1d06d5897aa92c346b804516b7ecedd8bf679db5c2b02651910c118e35733ebf02191ccaf167c126b2feb7c918c11df3009eaba1a3ec98579f09e1cc11a678b60c47e6dd16469d51c5dd5e4da886b6cbe1038f72f8ae0563ecb85f874fc414b45b868236f761cb95ab1b6e13e33471260f3f176f5b32bd789f3ce3166eb78cb281a69440f716d83424dc0b4473d5", @generic="c0730902946ade3fa45684455c7c4d60b5f141db163367fdb30c481f1017ae5ec3bb3e6f759d269de0e4150653495e6cbad9c34f59f941e5a8833e5005f7950f1392d42926f5304e08cb861eeb511c8cfa6c34a93ad44f189bdd5f5f8b7f6670da7b96c064793f928e4cbeb994a7242b130c6052", @generic="a6b81ea20aad3cd6ab110dfb57724b3031dcb5c9a1998942affa254457fd0e23d1e6961fd756", @typed={0x8, 0x59, 0x0, 0x0, @fd}, @typed={0x43, 0x3b, 0x0, 0x0, @binary="25770fbdd759b40b98de97d743188fef5d1ad80c64f98edb2179ad702bd77b271a3c1215e9b2aba79e4adab0bf56ac4a5c53d30e6eb595b77a4e0d0e9a2755"}, @typed={0x8, 0x75, 0x0, 0x0, @ipv4=@private=0xa010101}, @generic="b8268dcbbcf1afe24f1654eb8b794cb71eaac6a58fa12c02e19cc411a1ce29e5c394cdfc903cd3e7ebd90a734f7898fd70caa39ac6312e38930762beccf1eb46e535314a521270398e1bb41c1687487bb2f6957fbcee9608cd242d27bdf78b181d51438df3dc"]}, @nested={0x240, 0x7e, 0x0, 0x1, [@generic="49356374070e5af0d6bbdb6fafed565bf66987329a29ab12969af4dc7e2d64bb6aefc17b09e76b2ead1cd9287357209a144723b520a61668a9933af973cbf4a39295fce6cedbde2e3e86410acc42c45da5", @generic="b0cccc96439dd2", @typed={0xd5, 0x8d, 0x0, 0x0, @binary="1803ce7699060c0062bd0e76621d71c70e0d61375a66e764ada409220118f98dfe8253015283c9aa6476aa0797162939a86786e62114bd8a79831c78fea664cab0710eb04418e93f71c0feb40f3753c2d450b83d8417800c6c397452429e788b8c19e3b9901449fec877d176a20e190bd67e3ffaeeda501371efa997b6950b6915d207c82392e65e9233c837b618e5d38cea7835fa8eba77e06ed8f1620a92ab37b2c5fadec7f0fa90d8968f9a3b5b091722edc4ffe2d1a0fdf622e21454d94f2623184640d5c82b97c8421ac97b40e179"}, @generic="6805e56d58cddbcbda4cba22c9fcbc7c1f198313459d4339bc79ecec2a95f98d3bfe1f7a274740d2495fc6f1db9a9be1c2d0e8ce08e1b2db65b4f7394dede91463867c19e7a6e976606343bc4d2f39b6008da9", @generic="10d5d1e6b38debdfea5a0dc3f46508216f238d323642a860ce84e962f5ab36b510bc4d7c5b19adfa1ec9a9961d0b5a08e345c1776a08338c91261b34c228e6d41990b2f8af5520e5e9b3e24b816661e910d57d034aa7a6b214681bd0629e8be6cde9f6f48e1fbee7cd588bed3460cb1852dcf6745a145df88f5bb7081c42bfdd3c1505faaf4ac26ba96b8ac0c207ce22a19d19d6080d33aa35", @typed={0x8, 0x6d, 0x0, 0x0, @str='}&:\x00'}, @typed={0x18, 0x85, 0x0, 0x0, @str='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00'}]}, @generic="4990bfb468ac326bcd48a9114a48176ac3a70605a97b925915e3af7adbfcf4725c8cd077190e278b52beca5cbcc2d1e3a55627165c6b832091600a5b0a1d76cced508829ad81f5303c792b80dfb1af15f1142deab79dd2219a0c522920ef59c97ae07bffcc86214bff08c430e2d4504bd1b2b4061f2c67a4936d7879ab53cfd9a1639a74", @typed={0x8, 0x38, 0x0, 0x0, @pid}, @typed={0x8, 0x94, 0x0, 0x0, @ipv4=@private=0xa010100}]}, 0x728}, {&(0x7f0000002ec0)={0xfc, 0x38, 0x400, 0x70bd2a, 0x9, "", [@nested={0xea, 0x1c, 0x0, 0x1, [@generic="92", @generic="3cad74981602fb0efa48850b9ba71ef07c991ec86c778f26df94fe7bb1bc1562cdc1355217a6478e9c37a44e34d3a42e33c5dd758a7f2857afaff884c8fa6884041b626a042fc389d7a5a671b43c2a3889c9021f0db89c6299a2b1d76aa61c390a3e3584b8a813d77a7f6151f1785f3cd63556d79995e90d0449c7050876d9bc653d589d9b40870dba25b5bd4c49e14d257280b64ba5147b5cc29c6ef053e0bb9f9597cb8a99bf9cc869a6a8808b3957eed90f978b26d19d5074837ea36c7d3bd49f8d42c3378f93ffbc570cbffeaa6c9aa07cb4273291973f5901d74a", @typed={0x8, 0xa, 0x0, 0x0, @u32=0x6}]}]}, 0xfc}], 0x4, &(0x7f0000003440)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xee00}}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff}}}, @cred={{0x1c, 0x1, 0x2, {r0, r1}}}, @cred={{0x1c, 0x1, 0x2, {r2, 0x0, r3}}}, @rights={{0x20, 0x1, 0x1, [r4, r5, r6, 0xffffffffffffffff]}}], 0x118, 0x80}, 0x4010) sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 345.273272][T30502] loop2: p3 start 2127165541 is beyond EOD, truncated [ 345.280125][T30502] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 345.344649][T30539] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 345.353169][T30539] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 345.394743][T30539] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 345.403362][T30539] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 345.421934][ T1033] loop2: p1 p2 p3 p4 [ 345.428515][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 345.452549][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 345.485110][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 345.491935][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:08 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:08 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x0, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:08 executing program 2: syz_read_part_table(0x2500000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:08 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_io_uring_setup(0x3ede, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_ASYNC_CANCEL, 0x1) r2 = fsmount(0xffffffffffffffff, 0x1, 0x78) clock_gettime(0x0, &(0x7f00000018c0)={0x0, 0x0}) recvmmsg(r2, &(0x7f0000001840)=[{{&(0x7f00000001c0)=@phonet, 0x80, &(0x7f00000014c0)=[{&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/42, 0x2a}, {&(0x7f0000001300)=""/253, 0xfd}, {&(0x7f0000001400)=""/133, 0x85}], 0x4, &(0x7f0000001500)=""/161, 0xa1}, 0x7ff}, {{&(0x7f00000015c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000001780)=[{&(0x7f0000001640)=""/85, 0x55}, {&(0x7f00000016c0)=""/176, 0xb0}], 0x2, &(0x7f00000017c0)=""/70, 0x46}, 0x4}], 0x2, 0x40002041, &(0x7f0000001900)={r3, r4+60000000}) syz_io_uring_setup(0x3ede, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000000)=@IORING_OP_ASYNC_CANCEL, 0x1) r7 = syz_io_uring_setup(0x9c2, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r10}}, 0x0) syz_io_uring_submit(r0, r6, &(0x7f0000000140)=@IORING_OP_WRITEV={0x2, 0x0, 0x2000, @fd, 0x446, &(0x7f0000000080)=[{&(0x7f0000000000)="4276547600b3082b60325c812ccef380e003fefd639d7dd4a91787364fc113ca9b816b0d92f8f2609c5b42d2", 0x2c}], 0x1, 0xb, 0x0, {0x1, r10}}, 0xfffffffe) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:08 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:08 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x76d1853ce3c4a5b3, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0xffffffffffffffff, &(0x7f00000000c0), 0x1, &(0x7f0000000100)) keyctl$set_reqkey_keyring(0xe, 0x5) request_key(&(0x7f0000000080)='big_key\x00', &(0x7f0000000000), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0xfffffffffffffffd) [ 345.597142][ T1787] __loop_clr_fd: partition scan of loop2 failed (rc=-16) [ 345.597697][ T616] Buffer I/O error on dev loop2p4, logical block 33008, async page read [ 345.605686][T30543] Buffer I/O error on dev loop2p1, logical block 131968, async page read [ 345.621280][T30543] Buffer I/O error on dev loop2p1, logical block 131969, async page read [ 345.689627][T30573] loop2: detected capacity change from 0 to 264192 [ 345.732933][T30564] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 345.741526][T30564] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 345.757560][T30573] loop2: p1 p2 p3 p4 [ 345.765849][T30573] loop2: p1 size 78398975 extends beyond EOD, truncated 11:03:08 executing program 2: syz_read_part_table(0x2600000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 345.788309][T30564] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 345.791976][T30573] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 345.796811][T30564] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 345.810100][T30573] loop2: p3 start 2127165541 is beyond EOD, truncated [ 345.822073][T30573] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 345.961984][T30616] loop2: detected capacity change from 0 to 264192 11:03:09 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r3) 11:03:09 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:09 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000000140)=@pppoe, &(0x7f0000000000)=0x80, 0x80c00) getsockname(r0, &(0x7f00000001c0)=@sco, &(0x7f0000000240)=0x80) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x0) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:09 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x20000, &(0x7f0000000140)="689e11f208ca91bcafbd297c465c785a46e3d3a6c86bf5949c8b67f31cfe9f3d834aef212f668d3bb743b91f98c6b3beca42fa16e7336838dd8196c4fca226a2ee6e7c9eed6c16a5fc941399f93fb092e19499bf3e61d2201aa737ffd15829f9efeadac9bb9eb89d4647489850c1b817c51c940bbc195580c424036b2f7d0eabb950544fadc8149ec5a6650ed2cc55c4a34a664116c7d241f0300b26186627d7b63012785215650708769f25fc2b5e01da5303bb99547f45f798a1f13c885736465c0feee2773971932cc02cb41f4fb2cc5899189c27b608ba6e", &(0x7f0000000000), &(0x7f0000000080), &(0x7f0000000240)="2ccaf85740971da64a1c5a073d152d12e0fd27ae5a3315404329bc5607562f1ec47a459e81af67a8a4f1bd263d4829aa8670aa66c25d93f87310ac7a115fc36a2c9e1d436b3bed12eebe550e6510b384be8e6aebb00e00fe29657cc68ca3a4cdcbf76c9842f89890656e236a2c20f7f0e71c5e5bdf619d67ce6f910a36a66a391f10b54be45d42a28c0f372da609fa4092a4bd07148ef86eab63ff09274e97855929953a306060490c51163fff5ee46794e022df3d1be54b50aef4fabb873c5e66955e713997f46f969579a0a2247947ac9cea1d9811c36e83f5e6cd2ef1882ef12ea0aa84566f3d78da05df40814f2ac2dd5d1fda34b619206b3d9339414e6fb0d1ab12635569ae53a8fd9476d08870ad0b655cf388c119d5bcc5ff28c6adea391ce68242843eb695bba95065d7915c31dc081cc9fa18c293727b69484eae56be9fd12d9b6e544a3ae8b38b2923f35603d5baf0e24a6694f0ff893c3bf75c30ba8850d6aea31021bbc79121b87c884659286504565aa7c6a6fc2016b3d8fbd158852e5064a9f25a178c980d50931fc47f02e35c134f52d73e17772a4aa5a938c4dc93de377a1b3325ef1c1fa1ee0256509c24ac2164c899278ee7db3ba1858656035cc1cdaa318b48e5c28ef3fa37cf3ffa2f1eaf9a6914893dcd7872fa4d72369676b4d937ca60b5cb3e7f1ef0aa9ff40dc2ac679eabef029cdd700fbe90fbe31232accca24954dec7d14c6505971313fa38ec282a27aa9f83b423acddf76026dd1dddae08edc8224b5beafc5424aec58c20a21c960384ad2d5d9a8ced2fc8a38eebf7ff40348955c033a71e679d60221739e9c9c3255c05a96db5a9d3f92021fc2cfa8700f1b0b04b06c651680a3c2de136aa09c3e4534b771e9978e79b4cc09ec6e6b4bd024cb863235d5edc82824203ebf1aef7a2666ac307a96c14fd4b639d454f97016141969426dd3bfd2a67c72ec843ec37794599a1b6a9c346bbcd4ebd3467a5b9f42d074bf814fc32916ca3b45f3c226b1100fad9f0f8345d3456dff545137bf23df524c06b74826d3adf17f39e8b43d1a676c4b4d466cdb67603c98948f30dc8e8b84118dbddcff32525dc06f270c8b2ee9903d3c18cd3a264fda9726c71831c9abe40192456482624a3fc11fbb6ef727671be09198adc848315dd6537a4f88bd47b5fb20d9d1cdc17f1a500adc52cb55a55f593536ce86dd74e32cd2a9c3e32717804023de4853144a72b86581f82491ac66c754a2f8cff5343591464782e487a7a0ff4c883710a44cd28c9bb8fe1cd8096bf33cd6bac0c3241211330875f0242dd4e1e4e30cd606b01201e8d289afd9652411fd061d4972de4f0170476e7fd59340c2ac36e254b8c15f5b3c28bc14c809a2a2761abedf704eaf1d105c4e515c5298d92e6408c5322b359c3515962cec97c0d9cebb51a2ba6febcabd1d5055e05cb65e1d47654cf0cc7a0ed366958d5620f4629f3177f547a7b2938c7c01afa3d367fc561b5870b71a4f7d8901c0ced3124fc0e91965095995a3a73c5d4eeb9d22b3cfd88377a86247723a0129f42a47ad6183d231c5bacd7fb04d8ac7a68750a381cc6e0b9728080eb486aba53c766dd11fcb926eac17d916a854963072870123c11c8604683b1ad18d07ab7800f32cd27a76d8f5471a0d2e75b14c0bad01656d556f2daebd34a6d55595afdf94a845f4786bcd4f804c7818cfd4d1815298bae469d47e622cadfd45bc626c20d3acc50a5ac2bc33b55c1984cb3bc9a7649c49938fe4e85bf88707947eddcc2b3bb887b30ec943c53558a9f86519e13e95ac4105f10337926b244936d2c84efbe0d7ea39e6d1b8a97bc109d5b84d554db234d02695a3e3def4a11c01d308874ea2b2cfa380f6fbe9513bb6251993deb0b0e4ae355e4678314048a75b04ed8fe09a6942f96e0116355edf08aed006b941f682a5cbbeff41af21081d2b402f648742d560f0d0bde53b45cd67d295db5dc3d6f61251e2a210f6e10e5208e7c800052799ee1d1462a523ccb06c68b7e081eb00ce3ae2cd9b40aab30899178e709d9ec6f2a6b4c68aa5fc358aa989f2383f73c2cbcfd644ac3a05a2a486ead12566d9b5e43511bbce87773211d222e702b9ff156b446609a74af34459a8ec0166f4b7b43c95b586bccb932ccbab29b5b1e6422b5fe65ca4f3bc509b4c08bbfa4dec7ade7f016517fe1944ebee029848531fbd6bc66b2b0c93189b0e24925920e46601628a4e72d91bbea2be74ffcb1ef364c5afff15588cbf5b04ae9366fbb14eb964ed9d8c6f0f1d01c9d40aa89325b20ae0467ab5f9577b487b825fab72adb37d5ecf5ca3aa2e4e30b99478afdfbedcab7626e6b8c8ed36c93dabfcd7a7502edd1e92ba185212dbcb85f04a9405b024154ee0c4cca1dcece62cdc3ef7eea2c91a7615487bac669fdd166580885965094844162796288124864d143d995e10addd6bea20acdfa1d70ae62d7bcb3f4f6765e950b708063e41d2ffb24cf35f2a828abae2323dceecd29c820d41881ead4d7291b929a9eb24b45b78d7c3a100bf65817aea71545eb872433cad1354c890dbdf4f0399537b49965045f2d923cf0aa473f36a30d0b5edc8c6cdf717a96d94ea9bda9dbc1dce67b177b729b6197ea8eb2e908e27b22421c074905d588bcc05928d4f113ea37d7236bf7cfe2d418b6b64adfbb820b4acdb1024b44c8c2563cff2f12f939f83494e122d356ab07a82d8362b4e28f69a39cfe9102a796211f14b2eef9e0330ef66a89b0d0bcea7a598e34014bfa823ce3aa2e312450be4ddd7f55c0b0108cb143a9bb84f0e1e72bbc878d9809b29871876e6665fcc0a8c102f396e71b4620c728f71b2cdfbe47f84b2f74f6c8d734ec41c68e375afa01eb5bb4fbc7d8b892d24fb6a3d8d5f9aa669069f3aec39945fde6075daa09103814da348eed94436aa4798faf287e5d123fe25fdf7b5852338bb1f49c10d9267c50c0ad1b4a3895eaea6da5d28bc1b279ff3bac489a250172361a48b3354a482d4dfcf208f2d49f064845727de211fdc66048619f21d5bbe12a3bb7b8b8b9b5af0b589de7b1219b2235bc13fe3bb22e8eee5565825f463a9d2125c650cc4ebaa6a7b99764d0bcb4d4e4f16f92aedcecdd06dc33ff483cd3b8fafee73ba64e106673acb5afe205b2a6e2d15b5eb6ea494b7578b8b62aada6dac654288dc71e376be526a95244fb781e25ff5adafa40bc8e233605e168d046e7a6e955b3d38ce46888534d71c9e5d424fe0a1094f0041dea80d58745a2282d3f4c98b9b3743e2e022ffce1fd78f02613a885f94fc17c4ce9cdf6e41165ac374d379f96005e8a551ac633d9d53d1064c3b3ee9511cc0bfdf5b24369d5c7f85cb9c7d83acf9bac96cbfbe9108372b6b79c10e8668d6ac2c6823e59f34b1fa17bb44c34cc96b1ace23313ea561f93110f5119ded51cbc17e748ebfc02e526e7c5a82e9398a06b1a23a924c7a30e400921fc7908a0decb3ee91b3d91484a4dd99f2ff7270e76dbb4b1759ac7365cd33a50bdf0d12252327531e57f2963ff8e9e87bef1af825daafbb20ca1b278e8c823e79e0f5a354a601dc93e1413aa0b06278ae1c2c1fdecdda1d7dead37e9f3da480454de1173068490765ec216884fbcc4671007a83842b941c26bc7ff2b48f6b2b5de82f6533da3552659bfb78a79072a88979a16ec5f4c82240decc18ccc2daccdff762fbac2e01dd24e65f6a8d09e15455105797dcc6cc70de951663e30ad7f8a2e087d7b12a59556fc5b64ddbf470bfbb583174510977bfadb5d72e7e1df630b202ddbe4f4140fbf221672c9d177e6459a020e7be6f6e294370998174d1dbcd2af16d46624611e9422e5d1103e33427b5717c1bbd628146c37182f993a1fecdfe87569a5f088d97a12befc6657328f1c7af9a78ada0ce8253d3d1c1114212ac0bc7a05aebd0fd889a1610635d82e02c109c4d5aa01981ac370f7ac777ac8bbfb6fd33154acc8ca7fddbae137312fae01fe53c54c195495f7ea0b77c66a546f6a49e26207ef2c028c38e380b555f69c8d7b32aa831b5bdac10b806909ce747f49ae96f5f1e79f09114844f1a2f59d749373e8cce38e4ec4855aa2b36771b5723a435b150e6ed189b18dbfd8ace159dabed7c7c230ef51d39786f93c6255af6d1ea43b7c67078ce365c8d141844d8d17b143bfc3dc427f6a298556f04807e2dca9f889982047f1f4d8467b726dde467a75998750a402d0f8e9900cf55482f4ebde8c407d4f2698ef97ab900c7ab9db9aa12b1c41ff569c6b0d8dfc141bfa6941e03558cec447f2f4301039400137fce6d2ef5013a51ad83282ae68041575e14fff3a1165b47640823600013ff6c45368eaf296e1a82f607a3f1aa4f13d0a6c806bf1d076187f8e857a76146f775409dc2e5cf965bfb1eadf0e2dea5b687d79dd3b9dd668f5e3382419d51e2a7410f5ff610b7094e1cf8876e7be802de47c3ea1c971845bd2681ec52347712a0224351d8341ec9457c7af93f5798dea21a2940eb940cd1bffd445782d563d83b669803804b9ba27dbb48ab1f152895e0eb1f95a1627737a86bc5f51b88f7bfec0e61d272daf7207658c0effdd29adb9a21b5ed1a87d170363499727f545f5e9b49c8df0a061a4868de6a293caf41d78ed5a1ce7bbcf07013613655b8d2300c6e593e0aedbe244d3b4ba29862c3aa9508d1ff3cf95e8c4b73707396d55677f784349b75ca716fccd3bdc8badb94f309a7a15b133505f5c3bd23009da8cfd160b486f9988fa64985a512567b3c2b7922584997eca99a961a823cf8974806f341f3396803ae6ff73816a8efefc94118296a53dcbf16e343cc440aa990853a2a0b75f142a3fa01c37d07527fd15af2fbf37955693a06766a4f48384ca3bccd9f9423f173f218aebeb51365bae0783adbf47522be9c9e69baeac0e7bbe9bfa35432c54ab258dcefef35709d580e5ab5b42e3707659576b88c480753616c08d9c025a9afbf51ca8704047f2b41c2fadef82573f640aac94dbde0c8e1aca075b9c36a1c57b71cd2b7b93e443b57e8fe1e31348cec76f8aa6657b641ba6ae02cca7ac172fd39a68691d3968b9080023fe625cd4fa373495e9e7934cf4d3cb2258495bab5356b0535f6da15b926e9b166789113105b1b17abe53335da1431a98c4fcf7945d807f51b9e9bc07c3fb020b22e974499515e67f75f86427f8ab1035fd9651785af9a6b6e40516e4f4a024d822f893dec2cb9496307093505004ad788bc39e378b9f32c1fc60cb64a56e64d969b63462c0b9f47bbf6054e0356f7fc8dca2d73457482b4ad4572f907b97f1a55a7a6228a9924deefe525ac6bf279aa42d1c864407a593dd99581c1c4824ca0b391a8624fc2e0aae5d768b3f1c382d4a85eb7239c1c09c0e654f03b9c018ccbb59e5fb4453bfd687f49ef519a1a307371e5ce2d42eebef9d39196ce0f029a68c2c7a604e328da443e680209db1512ff568f34b11718828d5f78d6e21339666961775c24906703e6b22676ed86ff8ca293a674ff7c4e5608d5c0226e817cbc946d36e4c84b45050153a7da1f40ffc695773a262b8924c718d9672c6a0038358ca842e30cb8d0c2cf6154041e814fd7ab1d63903db4e5b538ffbc9cbe476b8b870301ee922d00a69cc6a5e09ee332fe2e4499dd668f840f4db7a32e2be6e336b14d95f387d722339997f111b6f3a14a04547fb31c13dd4d1ed0b3623cfeebd3d4ad3ed531c9a9b46fb433d4ca0a1125f96e4335cc63b3c50949a48c7c19bcb3fb1f74532c565") keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 346.037610][T30616] loop2: p1 p2 p3 p4 [ 346.043408][T30616] loop2: p1 size 78398975 extends beyond EOD, truncated 11:03:09 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 346.096984][T30616] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 346.146767][T30616] loop2: p3 start 2127165541 is beyond EOD, truncated [ 346.153580][T30616] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:09 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 346.647014][T30565] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 346.655554][T30565] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 346.686519][T30565] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:03:09 executing program 0: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:09 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0xc1034000, &(0x7f0000000140)="88435a25fe9ae11607ea34282fd4fb4a28aa4cb326c81352ce80dde4eb4b8b757b34bdb1d599fc3cfd9dc2324d1787c4773d69e6b54bb28eed88ab0c4db01ebe347007f2d766428ec6ce96", &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000001c0)="4eb9b93374e55afc0f1f67bacf765df0c7e25b7529bfba73cfa6b114e0d984223e5f8c64b79cd357b014e23ae86b088dffd611e22f266d2790517c6c27b346a3505b23b52766ccea353b05cebde66b7edec069d4df59da6a") clone(0x8000000, &(0x7f0000000240)="0d90f55fdad9a577aa27240e4153c6bae13d674bf7e0afb52689c6b6cf19a447f8df65dcb2421be206e113244eaf53d12a54d708c33e66e44b7f1806c857240d4b118a9a0cb48f5a1409b8f7a72d926a479aff3207dcceed559524a608ef22de0aaed1a9205fb8576c3552fa114eceb809fc91a039531197ac2b04885a05e1e7e6189cdae8e34bf250da", &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)="dff460a981f3d28f0bcc22d94e4a8adf30eeed8c321308173e38f1d624ebb9ac6797f36695a1571b76") keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:09 executing program 2: syz_read_part_table(0x3e00000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:09 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 346.695049][T30565] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:09 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 346.784986][T30660] loop2: detected capacity change from 0 to 264192 [ 346.815354][T30660] loop2: p1 p2 p3 p4 [ 346.821115][T30660] loop2: p1 size 78398975 extends beyond EOD, truncated 11:03:09 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) keyctl$set_reqkey_keyring(0xe, 0x5) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 346.828919][T30660] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 346.837648][T30660] loop2: p3 start 2127165541 is beyond EOD, truncated [ 346.844462][T30660] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 346.847603][T30657] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 346.860081][T30657] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:09 executing program 0: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0xc1034000, &(0x7f0000000140)="88435a25fe9ae11607ea34282fd4fb4a28aa4cb326c81352ce80dde4eb4b8b757b34bdb1d599fc3cfd9dc2324d1787c4773d69e6b54bb28eed88ab0c4db01ebe347007f2d766428ec6ce96", &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000001c0)="4eb9b93374e55afc0f1f67bacf765df0c7e25b7529bfba73cfa6b114e0d984223e5f8c64b79cd357b014e23ae86b088dffd611e22f266d2790517c6c27b346a3505b23b52766ccea353b05cebde66b7edec069d4df59da6a") clone(0x8000000, &(0x7f0000000240)="0d90f55fdad9a577aa27240e4153c6bae13d674bf7e0afb52689c6b6cf19a447f8df65dcb2421be206e113244eaf53d12a54d708c33e66e44b7f1806c857240d4b118a9a0cb48f5a1409b8f7a72d926a479aff3207dcceed559524a608ef22de0aaed1a9205fb8576c3552fa114eceb809fc91a039531197ac2b04885a05e1e7e6189cdae8e34bf250da", &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)="dff460a981f3d28f0bcc22d94e4a8adf30eeed8c321308173e38f1d624ebb9ac6797f36695a1571b76") keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:09 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:09 executing program 4: r0 = accept4$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, &(0x7f0000000240)=0x46, 0x0) sendmsg(r0, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) request_key(&(0x7f0000000000)='.request_key_auth\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000140)='\xb6\x00', 0xfffffffffffffffc) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x20) open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) ftruncate(r1, 0x208200) getpid() perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x11, r2, 0x0) read(r2, &(0x7f0000000180)=""/19, 0x11fffffc7) execveat(0xffffffffffffffff, &(0x7f0000000540)='./file1\x00', 0xfffffffffffffffd, 0x0, 0x1000) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) keyctl$set_reqkey_keyring(0xe, 0x6) [ 346.903333][T30657] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 346.911852][T30657] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 346.936797][T30660] loop2: detected capacity change from 0 to 264192 [ 347.008973][T30660] loop2: p1 p2 p3 p4 [ 347.013124][T30660] loop2: p1 size 78398975 extends beyond EOD, truncated [ 347.030376][T30674] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 347.034945][T30660] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 347.038965][T30674] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 347.047698][T30660] loop2: p3 start 2127165541 is beyond EOD, truncated [ 347.064018][T30660] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 347.095464][T30674] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 347.103943][T30674] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 347.141785][ T1033] loop2: p1 p2 p3 p4 [ 347.155303][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated 11:03:10 executing program 0: syz_read_part_table(0x2500000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:10 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) io_setup(0x9, &(0x7f00000000c0)=0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x1f}]) shutdown(r1, 0x0) clock_gettime(0x0, &(0x7f0000008c40)={0x0, 0x0}) recvmmsg(r1, &(0x7f00000089c0)=[{{&(0x7f0000000140)=@l2={0x1f, 0x0, @none}, 0x80, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/135, 0x87}, {&(0x7f0000000280)=""/80, 0x50}], 0x2}, 0x1}, {{&(0x7f0000000300)=@l2tp6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000380)=""/251, 0xfb}, {&(0x7f0000000480)=""/194, 0xc2}, {&(0x7f0000000080)=""/60, 0x3c}], 0x3, &(0x7f00000005c0)=""/166, 0xa6}, 0x1}, {{&(0x7f0000000680)=@nfc_llcp, 0x80, &(0x7f0000000780)=[{&(0x7f0000000700)=""/67, 0x43}], 0x1, &(0x7f00000007c0)=""/4096, 0x1000}, 0x38e5}, {{0x0, 0x0, &(0x7f0000002840)=[{&(0x7f00000017c0)}, {&(0x7f0000001800)=""/4096, 0x1000}, {&(0x7f0000002800)=""/54, 0x36}], 0x3, &(0x7f0000002880)=""/210, 0xd2}, 0x1c00000}, {{0x0, 0x0, &(0x7f0000003b80)=[{&(0x7f0000002980)=""/120, 0x78}, {&(0x7f0000002a00)=""/123, 0x7b}, {&(0x7f0000002a80)=""/78, 0x4e}, {&(0x7f0000002b00)=""/99, 0x63}, {&(0x7f0000002b80)=""/4096, 0x1000}], 0x5, &(0x7f0000003c00)=""/251, 0xfb}, 0x3}, {{0x0, 0x0, &(0x7f0000003d00), 0x0, &(0x7f0000003d40)=""/66, 0x42}, 0x6}, {{0x0, 0x0, &(0x7f0000003f80)=[{&(0x7f0000003dc0)=""/41, 0x29}, {&(0x7f0000003e00)=""/2, 0x2}, {&(0x7f0000003e40)=""/3, 0x3}, {&(0x7f0000003e80)=""/238, 0xee}], 0x4, &(0x7f0000003fc0)=""/4096, 0x1000}, 0x101}, {{&(0x7f0000004fc0)=@caif=@util, 0x80, &(0x7f00000064c0)=[{&(0x7f0000005040)=""/220, 0xdc}, {&(0x7f0000005140)=""/224, 0xe0}, {&(0x7f0000005240)=""/88, 0x58}, {&(0x7f00000052c0)=""/227, 0xe3}, {&(0x7f00000053c0)=""/4096, 0x1000}, {&(0x7f00000063c0)=""/196, 0xc4}], 0x6}, 0xfffffffd}, {{&(0x7f0000006540)=@in6={0xa, 0x0, 0x0, @dev}, 0x80, &(0x7f00000077c0)=[{&(0x7f00000065c0)=""/6, 0x6}, {&(0x7f0000006600)=""/94, 0x5e}, {&(0x7f0000006680)=""/4096, 0x1000}, {&(0x7f0000007680)=""/195, 0xc3}, {&(0x7f0000007780)=""/2, 0x2}], 0x5, &(0x7f0000007840)=""/4096, 0x1000}, 0x6c}, {{0x0, 0x0, &(0x7f0000008980)=[{&(0x7f0000008840)=""/157, 0x9d}, {&(0x7f0000008900)=""/124, 0x7c}], 0x2}, 0x80000001}], 0xa, 0x122, &(0x7f0000008c80)={r2, r3+60000000}) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 347.199748][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 347.203139][T30710] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 347.207584][ T1033] loop2: p3 start 2127165541 is beyond EOD, [ 347.215467][T30710] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 347.221456][ T1033] truncated [ 347.221464][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 347.253526][T30710] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 347.262002][T30710] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:10 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:10 executing program 2: syz_read_part_table(0x3f00000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:10 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:10 executing program 0: syz_read_part_table(0x2500000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:10 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) keyctl$set_reqkey_keyring(0xe, 0x6) 11:03:10 executing program 0: syz_read_part_table(0x2500000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:10 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x3) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:10 executing program 0: r0 = accept4$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, &(0x7f0000000240)=0x46, 0x0) sendmsg(r0, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) request_key(&(0x7f0000000000)='.request_key_auth\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000140)='\xb6\x00', 0xfffffffffffffffc) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x20) open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) ftruncate(r1, 0x208200) getpid() perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x11, r2, 0x0) read(r2, &(0x7f0000000180)=""/19, 0x11fffffc7) execveat(0xffffffffffffffff, &(0x7f0000000540)='./file1\x00', 0xfffffffffffffffd, 0x0, 0x1000) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) keyctl$set_reqkey_keyring(0xe, 0x6) [ 347.430509][T30735] loop2: detected capacity change from 0 to 264192 [ 347.476796][T30735] loop2: p1 p2 p3 p4 [ 347.480937][T30735] loop2: p1 size 78398975 extends beyond EOD, truncated [ 347.492283][T30735] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 347.502022][T30735] loop2: p3 start 2127165541 is beyond EOD, truncated [ 347.509127][T30735] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 347.549556][T30734] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 347.558151][T30734] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 347.613575][T30734] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 347.622139][T30734] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:10 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:10 executing program 2: syz_read_part_table(0x4000000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:10 executing program 0: r0 = accept4$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, &(0x7f0000000240)=0x46, 0x0) sendmsg(r0, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) request_key(&(0x7f0000000000)='.request_key_auth\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000140)='\xb6\x00', 0xfffffffffffffffc) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x20) open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) ftruncate(r1, 0x208200) getpid() perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x11, r2, 0x0) read(r2, &(0x7f0000000180)=""/19, 0x11fffffc7) execveat(0xffffffffffffffff, &(0x7f0000000540)='./file1\x00', 0xfffffffffffffffd, 0x0, 0x1000) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) keyctl$set_reqkey_keyring(0xe, 0x6) 11:03:10 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 347.996476][T30782] loop2: detected capacity change from 0 to 264192 [ 348.036997][T30782] loop2: p1 p2 p3 p4 [ 348.041212][T30782] loop2: p1 size 78398975 extends beyond EOD, truncated [ 348.050536][T30782] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 348.058643][T30782] loop2: p3 start 2127165541 is beyond EOD, truncated [ 348.065574][T30782] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 348.128647][T30787] print_req_error: 10 callbacks suppressed [ 348.128661][T30787] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 348.128794][T30789] blk_update_request: I/O error, dev loop2, sector 263946 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 348.135644][T30782] __loop_clr_fd: partition scan of loop2 failed (rc=-16) [ 348.146931][ T616] blk_update_request: I/O error, dev loop2, sector 263946 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 348.160570][T30795] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 348.165036][ T616] buffer_io_error: 3 callbacks suppressed [ 348.165049][ T616] Buffer I/O error on dev loop2p1, logical block 131968, async page read [ 348.177077][T30795] Buffer I/O error on dev loop2p2, logical block 33008, async page read [ 348.205703][ T616] blk_update_request: I/O error, dev loop2, sector 263948 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 348.210969][T30795] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 348.222269][ T616] Buffer I/O error on dev loop2p1, logical block 131969, async page read [ 348.243366][ T616] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 348.244712][T30782] loop2: detected capacity change from 0 to 264192 [ 348.254806][ T616] Buffer I/O error on dev loop2p4, logical block 33008, async page read 11:03:11 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:11 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000000000)) 11:03:11 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:11 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 348.301894][T30736] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 348.310720][T30736] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 348.339234][T30736] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:03:11 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_io_uring_setup(0x3ede, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_ASYNC_CANCEL, 0x1) syz_io_uring_submit(r0, 0x0, &(0x7f0000000000)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x2, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1}}, 0x3f) keyctl$set_reqkey_keyring(0xe, 0x1) tkill(0xffffffffffffffff, 0x19) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 348.348023][T30736] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:11 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 348.414145][T30782] loop2: p1 p2 p3 p4 [ 348.418623][T30782] loop2: p1 size 78398975 extends beyond EOD, truncated [ 348.440180][T30782] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:03:11 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) r0 = request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) r1 = syz_io_uring_setup(0x3177, &(0x7f0000000040), &(0x7f0000000000/0x8000)=nil, &(0x7f0000006000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) io_uring_enter(r1, 0x0, 0x1b90, 0x3, &(0x7f00000000c0)={[0x3]}, 0x8) io_uring_enter(r1, 0x6d41, 0x0, 0x0, 0x0, 0x0) pwritev(r1, &(0x7f0000000380)=[{&(0x7f0000000140)="29097c5acb03d681aba6a99a6259f5699e958b23312664f05274478558af48a139f1295f0bb06604", 0x28}, {&(0x7f00000001c0)="3cf222e622f74ff929151cf116caca495c9f23a0074c57b1258e5593c6b71ba7a193f21b43e4baafc6afaf14b25f752ec4f75ff66fa8322248d05f8298fab3807af5976244f475c895cf3059018c7940832f950089a0780ab6e3b9da4e3d66bc3b6946af27664a85c73dc2750b8a90472500439d1f494bd0543279cd9727614ffede90062b7d73", 0x87}, {&(0x7f0000000300)="fa14e3058868b7531fb7af849c84281e72b3449e1c6641ff8fac41635b0b0f92858bf46c6dcb05dbec0391790887ba6023138a7200e3b9aece3c84c2eaae39e3d9eaac", 0x43}], 0x3, 0x5, 0x7) r2 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000100)='asymmetric\x00', &(0x7f0000000180)=@keyring) add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, r0) keyctl$KEYCTL_MOVE(0x1e, r0, r0, r2, 0x1) [ 348.461600][T30782] loop2: p3 start 2127165541 is beyond EOD, truncated [ 348.468464][T30782] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:11 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 348.520572][ T1033] loop2: p1 p2 p3 p4 [ 348.525333][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 348.560876][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 348.576509][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 348.583315][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:11 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:11 executing program 2: syz_read_part_table(0x4602000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:11 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:11 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 348.906858][T30860] loop2: detected capacity change from 0 to 264192 [ 348.964927][T30860] loop2: p1 p2 p3 p4 [ 348.969641][T30860] loop2: p1 size 78398975 extends beyond EOD, truncated [ 348.977292][T30860] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 348.985269][T30860] loop2: p3 start 2127165541 is beyond EOD, truncated [ 348.992097][T30860] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:12 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:12 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 349.404295][T30800] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 349.412918][T30800] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 349.444440][T30800] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:03:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x0) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:03:12 executing program 2: syz_read_part_table(0x4800000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:12 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 349.452952][T30800] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:12 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 349.555878][T30894] loop2: detected capacity change from 0 to 264192 11:03:12 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:12 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) [ 349.626355][T30894] loop2: p1 p2 p3 p4 [ 349.638307][T30894] loop2: p1 size 78398975 extends beyond EOD, truncated [ 349.655931][T30894] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:03:12 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 349.678279][T30894] loop2: p3 start 2127165541 is beyond EOD, truncated [ 349.685139][T30894] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:12 executing program 2: syz_read_part_table(0x4c00000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:12 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:13 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 350.095810][T30926] loop2: detected capacity change from 0 to 264192 [ 350.154830][T30926] loop2: p1 p2 p3 p4 [ 350.159283][T30926] loop2: p1 size 78398975 extends beyond EOD, truncated [ 350.173895][T30926] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 350.189822][T30926] loop2: p3 start 2127165541 is beyond EOD, truncated [ 350.196660][T30926] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:13 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:13 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:13 executing program 2: syz_read_part_table(0x6000000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 350.210177][T30882] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 350.218764][T30882] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 350.258349][T30882] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 350.266997][T30882] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:13 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 350.365679][T30938] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 350.374142][T30938] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 350.388899][T30948] loop2: detected capacity change from 0 to 264192 [ 350.415734][T30938] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 350.424457][T30938] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 350.444828][T30948] loop2: p1 p2 p3 p4 [ 350.454188][T30948] loop2: p1 size 78398975 extends beyond EOD, truncated 11:03:13 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:13 executing program 2: syz_read_part_table(0x6800000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:13 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) r3 = syz_io_uring_setup(0x3177, &(0x7f0000000040), &(0x7f0000000000/0x8000)=nil, &(0x7f0000006000/0x4000)=nil, &(0x7f0000000180), &(0x7f0000000240)) io_uring_enter(r3, 0x0, 0x1b90, 0x3, &(0x7f00000000c0)={[0x3]}, 0x8) io_uring_enter(r3, 0x6d41, 0x0, 0x0, 0x0, 0x0) r4 = syz_io_uring_setup(0x3177, &(0x7f0000000040), &(0x7f0000000000/0x8000)=nil, &(0x7f0000006000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) io_uring_enter(r4, 0x0, 0x1b90, 0x3, &(0x7f00000000c0)={[0x3]}, 0x8) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000280)={0x38, 0x0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0x4}, @ETHTOOL_A_FEATURES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x38}}, 0x0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44800}, 0x10) io_uring_enter(r4, 0x6d41, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD(r4, 0x4, &(0x7f0000000200), 0x1) fcntl$setlease(r3, 0x400, 0x0) connect(r0, &(0x7f0000000140)=@ll={0x11, 0x18, r2, 0x1, 0x8, 0x6, @random="cb1eb2dd84f2"}, 0x80) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 350.461927][T30948] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 350.470047][T30948] loop2: p3 start 2127165541 is beyond EOD, truncated [ 350.477035][T30948] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x800, 0x2a89, 0x3, 0x0, 0xf93, 0x7, 0x3, 0x0, 0x26f5}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) 11:03:13 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:03:13 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 11:03:13 executing program 3: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:13 executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 350.625108][T30969] loop2: detected capacity change from 0 to 264192 [ 350.663751][T30969] loop2: p1 p2 p3 p4 [ 350.668269][T30969] loop2: p1 size 78398975 extends beyond EOD, truncated [ 350.691887][T30969] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 350.699946][T30969] loop2: p3 start 2127165541 is beyond EOD, truncated [ 350.706879][T30969] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 350.753037][ T1033] loop2: p1 p2 p3 p4 [ 350.759573][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 350.768822][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 350.772488][T30990] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 350.784648][T30990] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 350.790647][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 350.802593][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 350.824088][T30990] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 350.832731][T30990] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:14 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:14 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) 11:03:14 executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:03:14 executing program 2: syz_read_part_table(0x6c00000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:14 executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x0, 0x0, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 351.211217][T31015] loop2: detected capacity change from 0 to 264192 [ 351.258604][T31018] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 351.267294][T31018] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:14 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 351.298924][T31018] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 351.307399][T31018] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 351.345698][T31015] loop2: p1 p2 p3 p4 [ 351.352925][T31015] loop2: p1 size 78398975 extends beyond EOD, truncated [ 351.368014][T31015] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 351.379825][T31015] loop2: p3 start 2127165541 is beyond EOD, truncated [ 351.387034][T31015] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 351.438641][T31032] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 351.447142][T31032] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:14 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) r0 = request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) keyctl$instantiate(0xc, r0, &(0x7f0000000140)=ANY=[@ANYBLOB="7570646174652064656661756c7420747275737465643a7f009d9806008ae37f730000a0f4dbae0000ed0000f83fbc08c3eb176a32b21e38b573c99e3a93e9b08d22458c768a065ca101fa10251d16b2edb4cf0d61b73471a156ff905e88a963f12b661574ee5f5f65e543795d9a45f9d7cf2717a3e83e6ff83d03d0891ba6093c71402aecf493e647bf55262da19588886f2e864710c9e9d2469a1b5134ca383967f984461a0a8ed5661aa931a105f25ecb"], 0x2c, 0xfffffffffffffff9) 11:03:14 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:14 executing program 2: syz_read_part_table(0x7400000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:14 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:03:14 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 351.492408][T31032] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 351.500859][T31032] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 351.545706][ T1032] ================================================================== [ 351.553908][ T1032] BUG: KCSAN: data-race in ns_capable / task_dump_owner [ 351.560858][ T1032] [ 351.563213][ T1032] write to 0xffff888134c5f02c of 4 bytes by task 31046 on cpu 1: [ 351.570937][ T1032] ns_capable+0x86/0xb0 [ 351.575109][ T1032] netlink_sendmsg+0x3ba/0x7c0 [ 351.579884][ T1032] ____sys_sendmsg+0x360/0x4d0 [ 351.584746][ T1032] __sys_sendmsg+0x1ed/0x270 [ 351.589332][ T1032] __x64_sys_sendmsg+0x42/0x50 11:03:14 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) syz_io_uring_setup(0x2de7, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r0, r1, &(0x7f00000000c0)=@IORING_OP_TEE, 0x0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f00000027c0)={&(0x7f0000002700)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000002780)={&(0x7f0000002740)={0x14, 0x0, 0x4, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x44000}, 0x81) syz_io_uring_submit(r0, r1, &(0x7f00000001c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0) r2 = syz_io_uring_setup(0x9c2, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r5}}, 0x0) syz_io_uring_submit(r0, r1, &(0x7f00000026c0)=@IORING_OP_RECVMSG={0xa, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000002680)={&(0x7f0000000200)=@ax25={{0x3, @default}, [@remote, @null, @netrom, @default, @netrom, @remote, @null]}, 0x80, &(0x7f0000002540)=[{&(0x7f0000000300)=""/175, 0xaf}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/119, 0x77}, {&(0x7f0000000140)=""/47, 0x2f}, {&(0x7f0000001440)=""/61, 0x3d}, {&(0x7f0000001480)=""/152, 0x98}, {&(0x7f0000001540)=""/4096, 0x1000}], 0x7, &(0x7f00000025c0)=""/152, 0x98}, 0x0, 0x10000, 0x0, {0xfffe, r5}}, 0x9) r6 = syz_io_uring_setup(0x3177, &(0x7f0000000040), &(0x7f0000000000/0x8000)=nil, &(0x7f0000006000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) io_uring_enter(r6, 0x0, 0x1b90, 0x3, &(0x7f00000000c0)={[0x3]}, 0x8) io_uring_enter(r6, 0x6d41, 0x0, 0x0, 0x0, 0x0) splice(r6, &(0x7f0000000000)=0xafe, 0xffffffffffffffff, &(0x7f0000000080), 0x8, 0x1) r7 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, &(0x7f0000000100)='asymmetric\x00', &(0x7f0000000180)=@keyring) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', r7) [ 351.594097][ T1032] do_syscall_64+0x4a/0x90 [ 351.598869][ T1032] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 351.604780][ T1032] [ 351.607099][ T1032] read to 0xffff888134c5f02c of 4 bytes by task 1032 on cpu 0: [ 351.614849][ T1032] task_dump_owner+0x2b/0x1d0 [ 351.619550][ T1032] proc_pident_instantiate+0x138/0x190 [ 351.625006][ T1032] proc_tgid_base_lookup+0x10c/0x180 [ 351.630344][ T1032] __lookup_slow+0x181/0x280 [ 351.634952][ T1032] walk_component+0x2a5/0x350 [ 351.639645][ T1032] path_lookupat+0x12d/0x570 [ 351.644341][ T1032] filename_lookup+0xff/0x390 [ 351.649031][ T1032] user_path_at_empty+0x3b/0x50 [ 351.653885][ T1032] do_readlinkat+0x87/0x200 [ 351.658491][ T1032] __x64_sys_readlinkat+0x4f/0x60 [ 351.665701][ T1032] do_syscall_64+0x4a/0x90 [ 351.670156][ T1032] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 351.676066][ T1032] [ 351.678384][ T1032] value changed: 0x00404040 -> 0x00404140 [ 351.684418][ T1032] [ 351.686826][ T1032] Reported by Kernel Concurrency Sanitizer on: [ 351.693662][ T1032] CPU: 0 PID: 1032 Comm: systemd-journal Not tainted 5.13.0-rc4-syzkaller #0 [ 351.702425][ T1032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 351.712506][ T1032] ================================================================== [ 351.733871][T31063] loop2: detected capacity change from 0 to 264192 [ 351.844189][T31076] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 351.852676][T31076] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 351.891522][T31076] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 351.900065][T31076] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:15 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:15 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) keyctl$set_reqkey_keyring(0xe, 0x6) [ 351.995451][T31077] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 352.004030][T31077] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 352.035029][T31077] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 352.043476][T31077] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 352.079725][T31063] loop2: p1 p2 p3 p4 [ 352.090596][T31063] loop2: p1 size 78398975 extends beyond EOD, truncated 11:03:15 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sendto$inet(0xffffffffffffffff, &(0x7f0000000140)="dc40bfcac040cf77b74079dfd824401a150bb0db7d3a857d8ddd1192d11028b0d85f3825b6134594cc0ab9c902ca143a41747be6dee9993acab10dbd1e6939442e1fbe0aebe843e2b0fd229d7bbc86fdfb5bd359b0a2cf4cbf03454cc8304aef59252717edad28630669d3fa4d2c3f4c15cccaafefd3bc1c04b19d3fc17b3393ef38aa1b18e4e8e945867122a93926bc43329ffa4b5df1ee609b355d4136109478925c23a7", 0xa5, 0x4000101, &(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x2b}}, 0x10) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 352.132470][T31063] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 352.149495][T31063] loop2: p3 start 2127165541 is beyond EOD, truncated [ 352.156442][T31063] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:15 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0xffffffffffffffff) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 352.241555][T31063] loop2: detected capacity change from 0 to 264192 11:03:15 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) r0 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000100)='asymmetric\x00', &(0x7f0000000180)=@keyring) request_key(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='\x7f\x11\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00\x99\xf9z\x98\xdd\'J6v\x98y\xbf\x84', r0) request_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f00000001c0)='syz', r0) [ 352.285402][T31063] loop2: p1 p2 p3 p4 [ 352.296685][T31063] loop2: p1 size 78398975 extends beyond EOD, truncated [ 352.322949][T31063] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:03:15 executing program 2: syz_read_part_table(0x779e53b900000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:15 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000000)='user\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\xde', 0xffffffffffffffff) [ 352.349060][T31063] loop2: p3 start 2127165541 is beyond EOD, truncated [ 352.356043][T31063] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 352.419682][ T1033] loop2: p1 p2 p3 p4 [ 352.423939][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 352.439159][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 352.455943][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 352.462732][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:15 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:03:15 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:03:15 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) r0 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000100)='asymmetric\x00', &(0x7f0000000180)=@keyring) r1 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f0000000100)='asymmetric\x00', &(0x7f0000000180)=@keyring) keyctl$set_reqkey_keyring(0xe, 0x2) r2 = add_key$fscrypt_v1(&(0x7f0000000140), &(0x7f0000000240)={'fscrypt:', @desc2}, &(0x7f0000000400)={0x0, "da99fc70577878dd338c2a98c179e155a2480470382477f027bde6e6db8068c1aa843f56e572ae77fa2033458e4ff5239b27005c8a4eb3b3aef503891b8eb98d", 0x2a}, 0x48, r1) add_key$user(&(0x7f0000000040), &(0x7f00000000c0)={'syz', 0x1}, &(0x7f00000001c0)="239df069450a9bd7dd8840d91274da15754cea2291edb3ffa11c7834bb1cfc6ee905f44160564568a7b78d61f8d3e43d7b5cee9935c2cd2ddbc393c41dac5beb5937c543397cbcf14b73fdf241652060d7eb672388ea068254e302b29595face266a6c60010069858c006ec0ebdd872a", 0x70, r2) request_key(&(0x7f0000000000)='.request_key_auth\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000300)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00\xa9y\x84p\xc5\v8]\x15\x95n\xed\x9e\x96\"\x13\x89\xfcW\\\v\xc7\x9cS\x15\x06X\x9b\xa4\xeaS\xd3\x8d\x86Q\xea\x133\xfe\x86\xdd\xf9\a\x8a\x92>\x82\xaaw\x88\x00\x91\xe5$\xbb\xd4\x05\xe1\x97\xe9MhOR\"\xf8\xff\xd0\xcf`\xb0\x9eD\xbc\x8cmH\xcaL\xad_\x89\xef%\x10\xfb\xe2u\x8e$7r\xc4\xcf\xa3\xb6\b\x01\xe5\xb6Zi\xf9~\xc15\b\x013\xff\a\xa3\xa55\xeeH.\x1c\x18\xe6M\xa8\xf3\xdd\"}+\xdd\x93\x9c\x1c_\x80\xbd\xc3\x8cb\xba\x06\xa0^\a\x9a\xd8\x9ed$\xd7?\xdd~\xe4+\xc9h1\x13\x06%\x03\x00)163N\xd6\t\x00\x00\x00/\x94\xe7\xa2\x97\aLk%\x8f\x00\x00\x00\x00\x00\x00\x00\x00', r1) 11:03:15 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 352.562012][T31144] loop2: detected capacity change from 0 to 264192 11:03:15 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x4, &(0x7f0000000200), 0x4) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 352.635962][T31144] loop2: p1 p2 p3 p4 [ 352.640236][T31144] loop2: p1 size 78398975 extends beyond EOD, truncated [ 352.652540][T31144] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 352.660993][T31144] loop2: p3 start 2127165541 is beyond EOD, truncated [ 352.667828][T31144] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 352.789668][T31170] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 352.798183][T31170] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 352.825969][T31170] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 352.834422][T31170] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:15 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r3) 11:03:15 executing program 2: syz_read_part_table(0x7a00000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:15 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) keyctl$set_reqkey_keyring(0xe, 0xffffffffffffffff) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) clone(0x80000000, &(0x7f0000000140)="b2df7ad097adc757994f351c44839ad4c0f9f6ab51cc706335de3af0c5e2c38c5a0a812b48ecb1d16b2b1d7af3ec4a123f4c92831103bf05d2d1c79ae2619c8d8b194f96", &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000001c0)="c90a6708a049b128d9e67de0c33145f2bc968bbbf56d9e984ffaa9d47a2272f5c6aac0c93aba13c1e323fc275aa7c8") 11:03:15 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:15 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000080)='user\x00', &(0x7f0000000000)={'syz', 0x3}, &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x01\x00\x00', 0x0) 11:03:16 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) ptrace$setregs(0xf, r0, 0x8000008, &(0x7f0000000080)="2e9bd274e38f9c8906596d19f71c") keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 353.016896][T31186] loop2: detected capacity change from 0 to 264192 [ 353.057486][T31186] loop2: p1 p2 p3 p4 [ 353.064295][T31186] loop2: p1 size 78398975 extends beyond EOD, truncated [ 353.072062][T31186] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 353.083907][T31186] loop2: p3 start 2127165541 is beyond EOD, truncated [ 353.090895][T31186] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:16 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_io_uring_setup(0x3177, &(0x7f0000000040), &(0x7f0000000000/0x8000)=nil, &(0x7f0000006000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) io_uring_enter(r0, 0x0, 0x1b90, 0x3, &(0x7f00000000c0)={[0x3]}, 0x8) io_uring_enter(r0, 0x6d41, 0x0, 0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:16 executing program 2: syz_read_part_table(0x7fffffffffffffff, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 353.386849][T31227] loop2: detected capacity change from 0 to 264192 11:03:16 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x24000, &(0x7f0000000000)="067ed6280d7aed8329a04fe3c5f64d501566d1bcc525f0a6f39e9a4c39b7de733baa1b726166978f1f49a3eaaf7209289223e996c5307d37329796c38a5f8fabfe538623c5e78d80cf1a2ba45a9b2d8e52085bfdd8e64f26a38b903c5c9d8198c55faae5115d56cfb6f96ce0c4c9c73b639070cb9979fd6bcd87", &(0x7f00000000c0), &(0x7f0000000180), &(0x7f00000001c0)="d74f4937e2cf6395cdb150178cebeb1e0bc937934441211d435589404b700e12a859327e8072992589609849f04b32c4fc934692e78ef0190a58f73d909a970034ede9dfccf41f2c5b4c92ee3e391578e8069ab90f0c9b8a543e74709e0cd9285325e2457a4384a37cf385226c91965f1bdd7f5146ee631f94533da691609e8a4d1d42f4983fd385ff31cd0f62d4600ba5de04376899aac5eb784372d51d77feda1d162b7a72da0007694496025b5e015fed0e3d2acb675207c03ff4f4514a5d66159f3b4d2c3db1405c102807d820e45076a4fbe6d18490089d135151bf86af4f19b205ae1ceb") keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000080)='.dead\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)=':\\\x00', 0x0) 11:03:16 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:16 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:16 executing program 2: syz_read_part_table(0x8004000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 353.445311][T31227] loop2: p1 p2 p3 p4 [ 353.449645][T31227] loop2: p1 size 78398975 extends beyond EOD, truncated [ 353.458042][T31227] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 353.466061][T31227] loop2: p3 start 2127165541 is beyond EOD, truncated [ 353.472886][T31227] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:16 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:16 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) r0 = syz_io_uring_setup(0x3177, &(0x7f0000000040), &(0x7f0000000000/0x8000)=nil, &(0x7f0000006000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) io_uring_enter(r0, 0x0, 0x1b90, 0x3, &(0x7f00000000c0)={[0x3]}, 0x8) io_uring_enter(r0, 0x6d41, 0x0, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, &(0x7f0000000000), r0, &(0x7f0000000100)=0x3, 0x400, 0x1) request_key(&(0x7f00000000c0)='rxrpc\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00 \x00\x7f\xed\x00'/24, 0x0) 11:03:16 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r3) 11:03:17 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x8a\xe3\x7fs\x05\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\xdcPu\x8d\x00\x00\x00\x00', 0x0) [ 354.005719][T31254] loop2: detected capacity change from 0 to 264192 11:03:17 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) io_setup(0x9, &(0x7f00000000c0)=0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x1f}]) shutdown(r1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 354.096036][T31254] loop2: p1 p2 p3 p4 [ 354.102786][T31254] loop2: p1 size 78398975 extends beyond EOD, truncated [ 354.164606][T31254] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 354.260358][T31254] loop2: p3 start 2127165541 is beyond EOD, truncated [ 354.267228][T31254] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:17 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:17 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000080)=0xc) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_io_uring_setup(0x3ede, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_ASYNC_CANCEL, 0x1) r2 = syz_io_uring_setup(0x9c2, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r5}}, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000140)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd_index=0x8, 0x0, {}, 0x9, 0x7fd6df0daa00fab3, 0x1, {0x0, r5}}, 0x2) keyctl$set_reqkey_keyring(0xe, 0x1) io_setup(0x9, &(0x7f00000000c0)=0x0) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) io_submit(r6, 0x1, &(0x7f0000000600)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x1f}]) shutdown(r7, 0x0) recvmmsg(r7, &(0x7f0000005bc0)=[{{&(0x7f00000001c0)=@l2tp6={0xa, 0x0, 0x0, @dev}, 0x80, &(0x7f0000001300)=[{&(0x7f00000002c0)=""/4, 0x4}, {&(0x7f0000000300)=""/4096, 0x1000}], 0x2, &(0x7f0000001340)=""/128, 0x80}, 0x3}, {{&(0x7f00000013c0)=@l2tp6={0xa, 0x0, 0x0, @dev}, 0x80, &(0x7f0000001980)=[{&(0x7f0000001440)=""/106, 0x6a}, {&(0x7f00000014c0)=""/122, 0x7a}, {&(0x7f0000001540)=""/252, 0xfc}, {&(0x7f0000001640)=""/206, 0xce}, {&(0x7f0000001740)=""/240, 0xf0}, {&(0x7f0000001840)=""/44, 0x2c}, {&(0x7f0000001880)=""/174, 0xae}, {&(0x7f0000001940)=""/40, 0x28}], 0x8, &(0x7f0000001a00)=""/247, 0xf7}, 0x4}, {{&(0x7f0000001b00)=@nfc, 0x80, &(0x7f0000001e40)=[{&(0x7f0000001b80)=""/248, 0xf8}, {&(0x7f0000001c80)=""/228, 0xe4}, {&(0x7f0000001d80)=""/164, 0xa4}], 0x3, &(0x7f0000001e80)=""/20, 0x14}, 0x7fffffff}, {{&(0x7f0000001ec0), 0x80, &(0x7f0000003340)=[{&(0x7f0000001f40)=""/45, 0x2d}, {&(0x7f0000001f80)=""/204, 0xcc}, {&(0x7f0000002080)=""/38, 0x26}, {&(0x7f00000020c0)=""/83, 0x53}, {&(0x7f0000002140)=""/122, 0x7a}, {&(0x7f00000021c0)=""/81, 0x51}, {&(0x7f0000002240)=""/193, 0xc1}, {&(0x7f0000002340)=""/4096, 0x1000}], 0x8, &(0x7f00000033c0)=""/95, 0x5f}, 0x4}, {{&(0x7f0000003440)=@nfc_llcp, 0x80, &(0x7f00000045c0)=[{&(0x7f00000034c0)=""/4096, 0x1000}, {&(0x7f00000044c0)=""/74, 0x4a}, {&(0x7f0000004540)=""/119, 0x77}], 0x3, &(0x7f0000004600)=""/91, 0x5b}, 0xffffd88c}, {{&(0x7f0000004680)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000005b00)=[{&(0x7f0000004700)=""/90, 0x5a}, {&(0x7f0000004780)=""/146, 0x92}, {&(0x7f0000004840)=""/83, 0x53}, {&(0x7f00000048c0)=""/197, 0xc5}, {&(0x7f00000049c0)=""/199, 0xc7}, {&(0x7f0000004ac0)=""/4096, 0x1000}, {&(0x7f0000005ac0)=""/5, 0x5}], 0x7, &(0x7f0000005b80)}, 0x7ff}], 0x6, 0x100, &(0x7f0000005d40)={0x77359400}) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:17 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:17 executing program 2: syz_read_part_table(0x80ffffff00000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:17 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000000)='.dead\x00', &(0x7f0000000080), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:17 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000080)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x05\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xb1\x00\x00\xed\x00\x00\x04\x00\x00', 0x0) [ 354.525576][ T1033] loop2: p1 p2 p3 p4 [ 354.543681][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 354.552108][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 354.569972][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 354.576813][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:17 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) keyctl$update(0xa, 0x0, &(0x7f0000000300), 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:17 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 354.941136][T31259] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 354.949612][T31259] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:17 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r3) 11:03:17 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) keyctl$set_reqkey_keyring(0xe, 0x4) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:17 executing program 2: syz_read_part_table(0x8cffffff00000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:18 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = open(&(0x7f0000000380)='./file0\x00', 0x80001, 0x60) r1 = socket$unix(0x1, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r2, 0x0) setresuid(0x0, 0x0, r2) stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000340), 0x10090, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@access_uid={'access', 0x3d, r2}}, {@posixacl}], [{@appraise_type}, {@fowner_eq={'fowner', 0x3d, r3}}]}}) keyctl$set_reqkey_keyring(0xe, 0x1) keyctl$set_reqkey_keyring(0xe, 0xfffffffffffffffa) keyctl$set_reqkey_keyring(0xe, 0x5) request_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f00000000c0), &(0x7f0000000300)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) clone(0x56400, &(0x7f0000000140)="0c837c0301b695fffada73d2e87b9182f7fd41b43145f0be98f4b537fdc1a627398e50b5fb36c3b2fc445c9ae0e0ac02f5f76cab37051ae183403a0bc7bcf3da489181ccf59c2712b72d120049324f9a8ef9f67dbf4e411842e929750e8e1d0184772189dc76db31dfa6b1c4c46efb1d71767800fa5eaf61498e1b0beb1b064d928539f0ec3311706ee519c7c7504f", &(0x7f0000000000), &(0x7f0000000080), &(0x7f0000000200)="28a702721e7e794e9b777d758f10f2080f64dee4ad186297c28db4318142d84a73d3d4f2cbc33c943ee8479eadd61dfafdaffc92494f4897998fc74a693de595be80dfcaab839b7484b4e53d405656436b1018679fb09640df4fca8546d5d149eaa39a56e38cdb48d2db969311d17676b34695c9a3ab1e53f8434bab9d550340d49fb2810b6e9da8922e2cb2b5d9d7f934ca75c6d68f911484811d2e19f12159ad6c0b5be1ae4f0585b1ee8d3ac9147074317ab5902bc187f895fe9a4d408593df629afe7c236b8c59fd2f13f85c91266ebd2c6da19c974c0436eae6e37c") [ 354.999035][T31259] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 355.007518][T31259] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 355.090013][T31351] loop2: detected capacity change from 0 to 264192 [ 355.193028][T31363] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 355.201520][T31363] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 355.230716][T31363] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 355.239243][T31363] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 355.267345][T31351] loop2: p1 p2 p3 p4 [ 355.272937][T31351] loop2: p1 size 78398975 extends beyond EOD, truncated [ 355.333119][T31351] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 355.347539][T31351] loop2: p3 start 2127165541 is beyond EOD, truncated [ 355.354378][T31351] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:18 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x20004000, &(0x7f0000000300)="cfb09357ca40c87499cba81326ab1d1bea854b39b7407a0cb451440a11ba15ac48aa95d09ab4f60a24c003515b0301bcf0741dcd07c6b4d063cd7a50d8f325eebb69263a78a34ee1a71265bd91ce1567f93ced", &(0x7f0000000080), &(0x7f0000000380), &(0x7f00000003c0)="652cc790409e7767a5adce319f00062cf0d34c335fd73e41b311e6ff35cc203f1f4e3c4a4240181a0062aabf53ab1cfac04b5a54bdf20fd125806353ee82362ff5d2be5b97e5bbeebb902fe602a82a851bf06af99adce98fdad4c6ddf34f907abf0cce5315b1d56ef5515574ea7f29c936cda74514be3f8564133b84970ee96fca770436f4262cce0f7a8fad28b3683d70d133726b393950b4ab97fb018ee27e8abc323367d8c6cea9965e5f4df5623ab28a2548292343dabbab58c1fb23e62be301d29077f0bea1be570f004bef24a4c804") keyctl$set_reqkey_keyring(0xe, 0x1) preadv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)=""/133, 0x85}, {&(0x7f0000000200)=""/204, 0xcc}], 0x2, 0x9, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:18 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:18 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) 11:03:18 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) 11:03:18 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000080)=0xc) ptrace$setopts(0x4206, r0, 0x80000001, 0x4) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:18 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) 11:03:18 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x228400, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_EPOLL_CTL=@mod={0x1d, 0x6, 0x0, r0, &(0x7f0000000000)={0x2}, r1, 0x3, 0x0, 0x1}, 0x8) keyctl$set_reqkey_keyring(0xe, 0x1) [ 355.530028][T31351] loop2: detected capacity change from 0 to 264192 [ 355.756935][T31351] loop2: p1 p2 p3 p4 [ 355.761333][T31351] loop2: p1 size 78398975 extends beyond EOD, truncated [ 355.769615][T31351] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 355.777618][T31351] loop2: p3 start 2127165541 is beyond EOD, truncated [ 355.784451][T31351] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:18 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:03:18 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, 0xffffffffffffffff) 11:03:18 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:03:18 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000008700)=[{{&(0x7f0000004380)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000044c0)=[{&(0x7f0000004400)=""/97, 0x61}, {&(0x7f0000004480)=""/46, 0x2e}], 0x2}, 0x1ff}, {{&(0x7f0000004500)=@vsock={0x28, 0x0, 0x0, @local}, 0x80, &(0x7f0000005840)=[{&(0x7f00000005c0)=""/64, 0x37}, {&(0x7f00000045c0)=""/130, 0x82}, {&(0x7f0000004680)=""/4096, 0x1000}, {&(0x7f0000005680)=""/26, 0x1a}, {&(0x7f00000056c0)=""/127, 0x7f}, {&(0x7f0000005740)=""/40, 0x28}, {&(0x7f0000005780)=""/161, 0xa1}], 0x7, &(0x7f00000058c0)=""/221, 0xdd}, 0x3}, {{&(0x7f00000059c0)=@pptp, 0x80, &(0x7f0000005e40)=[{&(0x7f0000005a40)=""/219, 0xdb}, {&(0x7f0000005b40)=""/208, 0xd0}, {&(0x7f0000005c40)=""/1, 0x1}, {&(0x7f0000005c80)=""/146, 0x92}, {&(0x7f0000005d40)=""/219, 0xfffffffffffffe34}], 0x5, &(0x7f0000005ec0)=""/163, 0xa3}, 0x2}, {{0x0, 0x0, &(0x7f00000070c0)=[{&(0x7f0000005f80)=""/48, 0x30}, {&(0x7f0000005fc0)=""/40, 0x28}, {&(0x7f0000006000)=""/148, 0x94}, {&(0x7f00000060c0)=""/4096, 0x1000}], 0x4, &(0x7f0000007100)=""/142, 0x8e}, 0x4}, {{&(0x7f00000071c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, &(0x7f00000074c0)=[{&(0x7f0000007240)=""/177, 0xb1}, {&(0x7f0000007300)=""/102, 0x66}, {&(0x7f0000007380)=""/238, 0xee}, {&(0x7f0000007480)=""/53, 0x35}], 0x4, &(0x7f0000007500)=""/188, 0xbc}, 0x6}, {{0x0, 0x0, &(0x7f0000007a40)=[{&(0x7f00000075c0)=""/64, 0x40}, {&(0x7f0000007600)=""/138, 0x8a}, {&(0x7f00000076c0)=""/246, 0xf6}, {&(0x7f00000077c0)=""/219, 0xdb}, {&(0x7f00000078c0)=""/22, 0x16}, {&(0x7f0000007900)=""/66, 0x42}, {&(0x7f0000007980)=""/24, 0x18}, {&(0x7f00000079c0)=""/80, 0x50}], 0x8, &(0x7f0000007ac0)=""/135, 0x87}, 0xffffffff}, {{&(0x7f0000007b80)=@pppoe={0x18, 0x0, {0x0, @link_local}}, 0x80, &(0x7f0000008000)=[{&(0x7f0000007c00)=""/211, 0xd3}, {&(0x7f0000007d00)=""/75, 0x4b}, {&(0x7f0000007d80)=""/200, 0xc8}, {&(0x7f0000007e80)=""/99, 0x63}, {&(0x7f0000007f00)=""/215, 0xd7}], 0x5}, 0x7}, {{&(0x7f0000008080)=@generic, 0x80, &(0x7f0000000800)=[{&(0x7f0000008100)=""/48, 0x30}, {&(0x7f0000008140)=""/134, 0x86}, {&(0x7f0000008200)=""/181, 0xb5}, {&(0x7f00000082c0)=""/98, 0x62}, {&(0x7f0000008340)=""/26, 0x1a}, {&(0x7f0000008380)=""/107, 0x6b}, {&(0x7f0000008400)=""/38, 0x26}, {&(0x7f0000008440)=""/105, 0x69}, {&(0x7f00000084c0)=""/93, 0x5d}, {&(0x7f00000007c0)=""/16}], 0x9, &(0x7f0000008600)=""/232, 0xe8}, 0x1}], 0x8, 0x21, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(r1, &(0x7f0000000000)='./file0\x00', 0x4000, 0x180) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000008940)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000008a40)={&(0x7f0000008900)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000008a00)={&(0x7f0000008980)=ANY=[@ANYBLOB="ea1e1a58", @ANYRES16=0x0, @ANYBLOB="000128bd7000fedbdf250700000008000300", @ANYRES32=r2, @ANYBLOB="0c009900070000001b0000001400040076657468300000000000000000000000050053000100000014000400"/60], 0x58}, 0x1, 0x0, 0x0, 0x40081}, 0x4000) io_setup(0x9, &(0x7f00000000c0)=0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) io_submit(r3, 0x1, &(0x7f0000000600)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x1f}]) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000140)='./file0\x00', 0x0, 0x8, &(0x7f0000000640)=[{&(0x7f0000000180)="60bf9ec6792614cd0c013f6c89554aca5ee83ebd709c6e9a20bc290c8b754fb09ec3cde7158b9030f26fc895d32a40c5a830c86a6251dbf3c30661521948627c7d25e7c0dd48fc38cae6ac4ca9e86a6876379d8df6790d36d8345a623b8174df63d3e29f3ae12278c664444cbccae2c294988449100f3bcd5c38dc1b599b5e618eda51cd7676cf975f06c8b3dd29e2c648cb55eb820de652ce0827d7", 0x9c, 0xeaf0}, {&(0x7f0000000240)="94d5766635cea2c4aebd577b2cb6afee0b9b85e8765b", 0x16, 0x4}, {&(0x7f0000000280)="0b5d0097bc731205e5577046436b17e707d0429dae7962228bd974b5d02ba3cd153ab84583be24eff76c8fdbd4fc8371e766727b097c381d9ac7c372c2a3761de7c8aabbfbd709feaa45ea5936f3f9a179756350c4eef7348bded0c3e5ad7976ebf0f7260ef26861b4816cb7d3a2d4b7685a1b3f039a7ac170b9d933d5cf4ed7601f8cbb0267354856c91a01e3db64d24b76c82c6b04e4243e737e305df11e92525a823204bb39e95821479d161a883afcd7b83094a07cec479d64267699af5a96fe2e51e68e3a7abe076111c2e05e48e1d7941981503150", 0xd8, 0x1000}, {&(0x7f0000000380)="494bafd6d7885024c4f8235fb4e40954042b4203728edbb63895ce686760bbf2b8", 0x21, 0xfffffffffffffff9}, {&(0x7f00000003c0)="16b928540509f36da42975dc132d757bf6d037b3153389dd3bcd75d0fb0bdeaa6f2e7c33c70cc18fb03d8a7809a2df3293dc9a863ae800954ddf0636283c4e2316257251e9f43f281a0ef874e9d2ddd76923f438e6141088a378f17cb7c86639e51bfe3fc07f03097e939fc67c5607672b50a1f61599", 0x76, 0x9a6e}, {&(0x7f0000000440)="a841e8dfe4c2bd08c86fb8fbd5fe61657bc181a2def86043d42daa716d79883ddd189cae8f2fc1f4a3ef2d", 0x2b, 0x9}, {&(0x7f0000000480)="e4029ec58c08ab9f5c364f1788620d573e0312ac71f2f25848e153c32084df37aaa13b90dd0f5eff2d9cdb396336603bbe4e195e2f8023e4313ac4d198a35cf742531feb777cf2a747be4ba699fa2a67edb070ca2d8567698731df63fdd8a4947a", 0x61, 0x20}, {&(0x7f0000000500)="f05758413f9c8d9e97406f300ad69ca74c36a0f41fcb81dbaab9d82385b4f0aed844a4e0503316b3f197eea0e865eeac8310cda8698a992af4523fc0d6810b79ce2a4d1dad8e0b20eee4532552f1539e43a1dbefb547a20cd6b9bc4f0252c3b574c39643004d2568fc00ef36ffa1838db013a01cee4cb805c7ad6c7804a079b6a61ae9bb9b6fbb231b535cb007c224", 0x8f, 0x3}], 0x221424, &(0x7f0000000700)={[{@fat=@dmask={'dmask', 0x3d, 0x7}}, {@shortname_lower}, {@shortname_winnt}, {@uni_xlateno}], [{@fowner_eq}, {@fsmagic={'fsmagic', 0x3d, 0x7f}}]}) shutdown(r4, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x4000084) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) shutdown(r4, 0x0) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) keyctl$set_reqkey_keyring(0xe, 0x1) getpid() ptrace$cont(0x20, 0x0, 0x101, 0x3d) 11:03:18 executing program 2: syz_read_part_table(0x97ffffff00000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:18 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) [ 355.958464][T31345] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 355.966911][T31345] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 356.001503][T31345] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 356.010102][T31345] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 356.075748][T31433] loop2: detected capacity change from 0 to 264192 [ 356.127332][T31433] loop2: p1 p2 p3 p4 [ 356.139654][T31433] loop2: p1 size 78398975 extends beyond EOD, truncated [ 356.147338][T31433] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 356.156088][T31433] loop2: p3 start 2127165541 is beyond EOD, truncated [ 356.163000][T31433] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:19 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) io_setup(0x9, &(0x7f00000000c0)=0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x1f}]) shutdown(r2, 0x0) sendmsg(r2, &(0x7f0000002200)={0x0, 0x0, &(0x7f0000001f00)=[{&(0x7f0000001e40)="59a6f813aee974cc808f01cabaf8c8d2ca4d889e38d16a7e23366bdbe6105879cdeb2554f8d192f70e56b972d09a0b010c2a038417d037de494f64d2ea22717f8cd5e4912248fdaeec9f17140375e3c4b175900ce67553e20b049b8bc83e818a91aa8c0c3e7239362487f32608b2e0b96930eaffe1add5106c8e76759fda79b18384309dd6f3311d50bae18c824f7d416f33a97ad8f0f05b1efbcbb8f7ce7c5d67c9bbaacdee77ad5379fa28076225b6384caf462eaa7d48ba", 0xb9}], 0x1, &(0x7f0000002240)=ANY=[@ANYBLOB="b800000000000000070100000100008032ded70d31e08239eee7070a5f10492bdfb731f5b104cac69d032888c1234e15d7f64be19c83eeccd25ccd38cdb47ce1730b917779275ad6c06d571544f370c1531cb15cb3e13c1f4ac08f143d6aa4ef8b569aa57c3ca53d1aa573068ec20d203c08d10000000037c1136a6b1f08d19d3a10c50a4490249e350444dc8ebe6270300da1f00caec8bd5feef0ed1d23990e78ffe180a1795d2f6b86536a6637a1e0cb827fb81c0000007800000000000000ff000000ff7f0000deaf66fb9ac675f5cb9194689a6a4ee45a0499d1c18eb8bcd9f3b862e992d633971eed823a9672aa1a4efa02bc218e5b0ce6c101afa9ef8cf4276f9330a70c25f6d9b15313d6184dce6a78d38e774d350af6519c389f097af364223f747d0beebf14bcaf819ae80098000000000000000d01000001800000e528e69f843cbce3cfe126e32f1822ff4b035ff6a64f314d0c3e94254f6c59346d1f31bd331b0cd72ba3f5a34a86386ee0bd350be114f3d54a8127c04dce7fd6f9d74b35032c032e0ffbad5723277c2a685d6a79db4e8d86854300283f7eac21c805a218e2d9c42df7aa57f20ed528beaebc68226457019fd792ef199d7ac99b79694c277cf4258be00000000000000000000000ce0000005579856d471af6919121507f01079bd2a0f950a8659f78b49d482deebb42411a8da06b15015f977f764bab226365ff47e73a27356f569e2d93f698afff823a3a9a180066e1cc67cb94191ce26434cc3f4937ce4b26a99fe3dcac80962b15ea228eaa903a157092cec6d04c960b2cc3091cf1ec9e142dffeacd4afe975762864d6840e789d1468e795c29402a6271b9974256965ff789874f4e2b15eeca8dfc05c06d02dd007148288121936a4f62f723f3e91f52e593ad06787fc431dac49ee8382bb5c5515d10854e6f090000000000aa0fbf32db9fea"], 0x2a8}, 0x20088004) sendmsg(r0, &(0x7f0000001c40)={&(0x7f00000002c0)=@nfc={0x27, 0x0, 0x0, 0x1}, 0x80, &(0x7f0000001740)=[{&(0x7f0000000340)="d888c2a06f37fb6ce7f5e89d4fa4076e4e12b35b0a892f0a1ffe58e49bf137c9a3883cf89910b16af33ef7e8f8da742cdb69e978e48d35b16311b75e422a3f0c78f237aee7812af80cda6a51835fa1c2e924f884049fa9280cd30e110267108d353462c6f156ef3b6d381529935f181c5aeb610dd3f25522817aa6b1b7e6747c8cf196338af752b3eb43f1358c555450ef2654a520ff1e096038", 0x9a}, {&(0x7f0000000400)="18ca87eb997b28d03f87e5f855965520f5a7dc37485569972248d2b827a220a1fa3912179345a442a1dc151fba096df8abc5", 0x32}, {&(0x7f0000000440)="21372cec388cb8a59ca9b74cbbe37c467321d1865d50005351f3a1a2823f52d0b90bb47bf53a29a40167d46b8cda1cbe0e686b4c9f4f6f0e001b8782a9a8efdf68ddb3b17ff02cb22ead5d5f0dfa464666acc4b7919e541a36498de2a65fea99a3f1527e7b33840b3ccea60c4f6e0958a80245e42f71c4eb161666ffb6f0866ab84ac3fed4d5ccfdbe1db83e10f9d2b560d0b57c955805d6ebefd93700dc966e330d53110eaec6bfd644eb3926ec0ed0969d00fd25919da8f5a2633578156bfbb69e502a3837938cea0c792770470c63c7fb75d087a1db9ccded559aef1359fdfa4679bdc3020a1a8e510f98d76381", 0xef}, {&(0x7f0000000540)="be81dce17f291b5a09fb5c73b51a1d6d84fc1e1700f9f4e022dbc3ba86ff32c53bbe2476fc1c7cadcc37c271696f67fd1cfd1ee74039f2", 0x37}, {&(0x7f0000000580)="671e6e77296e9d3d8c9454c53deacd841c8ce513dec83c7121119fdd3b2bbd7f40d6c1d738eb041fc3c3f85fb0a77b60b6726c554dccf6a4c0972a460490a93b5306e6256cc8de71f13abcf056411a685562c3eabaf8a879588f76c3787a46169a8e79480b2881bf6abbcbb49b0dc2bfad5f0c85106a59e486b4575eba86e01000a465d267cc1e057b01ecbea8cf1e60650155f7487b2b36ae89a3540738cda241f007a2aa9e1f7b224412fedd6e6b1be9596b05e7cb9b1ff89374eaadcf5465282547bbc3eb9d69f8303b204422b128b4324fe2b5662914a45e5b26dad2417d78e9654c4ea864d6b00a5af22f8136762bb3e0", 0xf3}, {&(0x7f0000000680)="c45ac785af9355aec596bfad0be597383ca4e3173dd78f12d057d09f67c4e0c090e60f45bcf6e6dfe4079633202bb82169188740cca84a34d68221f1c6e30e64d83dac7b69940868f3374332b8e0761f5354f5", 0x53}, {&(0x7f0000000700)="39a5332b7ba6d7a0302144d4ac1bdfbd572aaca6437220d153254548c8c89d77defffdf0bf896de126bed901af976efa62f86dcfbaf3a57331d521eb83dbcf8da74869876feb3d08c3b94b9938000d298d4edc6dcf6f5afef98e605aa77374b96b6e388393c75bbfec6d9cf451ee42d01b95ac7c15bb0ecbd59c473078fe6960d986075542be947bc917fdab17bfef12642f5cd714c202e680b6644fa6410751c83e07b992e3e51cea9fd29d0e449645fea8a8a6bd3716a8d71a234bfba3217c80aa49b5a918ab052b11f600a6ed32cc299eaaa8bb5147fafb9f426dc78f6ed751efdb417b4c4e3d983c1e882f873ac1886d0f9a3da8f1f9a94923fcb3a997e541d4a0b6a9ada220dd931d713b35fbdd56ea989a49ea1d000ecd5ed06901e01ca825afc8322985ff998f97665a67a5d9a29c7e3dc68161a5cd2ade9cc5a7f61fa1de5923412648f33f2879e282ae21d31e5084bc8e5610aad0a22a3dd3f4f1636aa7b731d0925a15f7a207b8ea1e36ed34b284d2120c1066e76e2d07b01ca3dededd5459db21411f352f81cee4cf5c24e7ba9607f9a790fb48e71c79ad047e98e28290c1d96aba4b62acec12d849960e8995e049a999868fba091af4e2204373b36ac491ff293cfd73723a1bdf708dce4bd41071daf1d46ff0c97bef30e20e76eedac75fda0a34fc6125b4e6cb23b549aa926d532be1999ce5fd13ce938a7a6942bee43b4e1d84964c6ea4eb82623cec94076b5f64b49239591a370088790d8aef2641693ab1aefec19fb46e1526f7c7fb8d2c46fc52543d2003a81ea6260fef0e791fa02f8d646f0aa5678b182f3cff8795169c55fa07be12927c6fa36e2a5b79517cff6265f640cb1477d758b2b2488e164dfaa4f063ad3b3debcf80879514ec31a2445c7fee3625c170dc9e1e1606d64bad0f4c819472f4571a05a9b45c046c504106f337b054b593815579ba2d0be6bef05f313369b4d9c20694864c02017dc1197411055973fc56fd6be324f15e0960e7d94d0df4129abaa2b21948d06755522a52306e6c9d87ee7592af20f572a54ab2db22ddf0b5b2c5745a28d2757e87b14c003710fd833cb89a22132acf7912ea64a27264c65bb06fbaa08fa3debc97debd15780fbabe4b501adeeeba4536299acffcba81aba99d030c7bfe84fd49b6d6cea8934a90ec7a3e8cd7a6e0e7985d1e135c4920860eb92ea21b34b0147ed4274bbf4af71be5512f03b8a49e4b804512ecc6e98065050e2ae5e1d839cf5a6e3edf802329effd3dd2a34537266138b16a6e69c5bd25bb61035e3684943db8e4306fee359574d49b6e3a9db3ca877b54f00dcf5d03e181f7e0d1554a6a1e97b29ef0c0f28b496156e17bf0b2bc3a36b401942b80216b40e22a5eae888702cf3c5eb9c3fa8e2c2a411c898681766db721ec5a23fac16ab585a46723972db8d7f5350c8b46dc2952619fd84ca3bee1ff1468fbf69abe9fb88d56ac7c42569d82e3d67c64cbae6239ceeb8b99101d722a91a74f98064c7fab87c63f4bc0fc313411f0faa907ef7d0dcf52ead89fb3cea7dc242af9892ce776ea8e0c1f61204a29574159617acdb6d27c5e19247d719ca9863f87af74dc3174ff892f8c31b2293ba7877b2677977e26a5c299fb07d000cae79b85dbd378671001e6f14a6b47166fb1d00b9ef72a2d3060c98e7665c193c54dfacdc5e93d54866617ddde0bdd2501cdd1f06f345444ad956eb72907fcb3adae009994b15639849e41b0fc7848d126675745f1ab6e5891025206fccc9e8dd91be96d06448f0120825b21323ade7ad90763f24d5baa151f4906f9e1dec4389f95e6953dbfaf90021567335e99a6c05ec12ddc0cfbf3319b0f8ac290a134b5a7e2cbafca71c0c0fdf4709da5e2e084c77dbbfa800773ea0699fc59ee6cb56fd67ec3cc1d87f7a430d243ac12ab153155592824610986af232e84b02049309a5c14bce3cbc64029674236fea9c85c2d33874454ffbf2e9a7dc51a671e4776e852d6768436a823411c2ab23e977f0419b6a0b64318256465e24e8dbd982b53df738dc52c54bf7d38e75e02e4c3267a4068ed99ba17bd0422a5b66acf827d565e6b13b997d9f09a5953d77a4f8f62d65721eb8d81bdbea15377574287e823da808291d6c00baed029b99460898b910a56720a8bd8a39bb8639d8ebcf8d4fdc25acfca143250513d2b0dff1a5c434bfc5cea3d85a787c90811e7e39058e61bd3dd746056585d2d673413c56d394a17a403f2059c8eaa599eeb02197df71f1b4f97a6b3d7dff441712870ab0020f01b248d650c8b4f12fab04a05d0ab9050d08c1445be541ebe1fa83e3c7adb01f276e7b37e329120ae7a2879f752cdd00ec63b86bfdbd7dc5b4c3fd922440466281a78aafa42d0208b252630106e148ade4a4dacf6dacaafcc450dda4f705bad1fb9757d37b4e627a6217550b54577276234c323c6a774492ef3ee79222fe6f70134a69206f28ee00f716fc1ff167076575f63a13fbc7068543526b1555d488cf32f394931529c75b835dc018a8323d7ee4d25cfa46cd750c2e0ef3fcab46b9a04b223c427a0ba8467a496eac17bb7446340ffa90aebd61a58dd028daf29948dd12fecfa45cba64703cb85f83666cc6905e9a47e1fdc72a2d3395bbf6d5d3ab031fe95299f09a6253b9f56917177a4e1feb454c3224ba2c90fc28ab35f6d03092af691ebd6739a6119b251444ec73d6ba3272b8e9649e25c926f3b266d67ef72b2ee4b03037bd557e3cf3745731f9df3d2de8a4f29be0eeda883c95603541b2735f37ca3061eff2cb953f53009d4207bf65053d291f398b2ede74bdd93ec4320f0be62f7aa0afc74095d8e6c3e3d96043e771df8687d77c48832b28bebb15508f55b791942f500898eb99a0800e21be0b8460facd7f77ff034356ec35f8d68e7fe688d8dbd3e27ee0dc60295f53584ee175a108fd7e038947502fde9c13ccb46a63a972195986c93d8fa3179e4f1b17cb0abaf6e8b1c8cb1f6d4f53f8c97ef58fb0f401688aab4153e8b9df84e2a560faef45864f3b43cf67778cb63918cd3e82dfb113f01a8f2299217d37297f0c6ea24fed4054b2ccbf78e80e6640abb018883472a1d9432d88cb5305a3d3feb5e0f8e0286f1b7db5bca9855f8a7f0733f8e0ff76bef5cb40d21e858cdce26aee46bf8c208c2625a3dbd4c629232abe5d613f1de04d1052313472c1660432f60bc51e72b4521d381e757c04836b0b043a3bf1fb722173b399d02eaae63c3fa003c335343086ff40da5cdce9b93e9795b903b9a2ec34661be1e2512aa862309d7b4cb1bc28c5435318855e2fc4024c4dc2c8522beec168266c14805e4c3fdff32b223a60adcd6de0501c1c9feac86d72d7ea4ace9f5e1c0289144e6d2d580c3b06edea520dfe48360fa76f62dcb68adbac55ac1d1b87f05ae38a49a0d628ddf48d037282da41b2ad8c24b0694a5839c2c7e971a11f819d1f174cfc314781ccbd725067127c64af907d5abc611f0c89a799b900d232b25fb5d019669efe66a1e95553d4363bb8e3afe7d1ce3730c2d3c2ab80f6289aedf35fcbb576f9da7e0fae850793a1d6c9a1ae77fa5b6673cceab1fd36f40322e489ca8d9ca27f88eaacf4d36769da9074bd54a274586b305661715287227cfe70e8ef4395f20c3cc9dbd99d7868bed00553af9710b0c5e8719104cf7a5897db9375f31a691b271687f625be06bfd3fb65593f92b497ab86fafae543aa87e1f231eccde8e8f7a6307ac69f20e36eabb96cdd93f19c57a5496340d2c976c4733ae9c23aa4e083df8c3c19d31a8ddb4d16090603d43aea698f724caab8f7772c04e3ab3966c9a45380e89754da82e43ca7f84365ea36aa4b85405b4bb2f2016b13e4ef4ae1d133763093ff2f0894a8565881fd93754790e355378f6f27e833854a2bc362d271034b7e5a31e0215dd0d368ff90c01f44ad75602b19bfb70d3c1653b01cdf27435d610a57bba0a2e6171c623e624f87271201f9f7f1d0fdb466d09986300e26b0f9e53822b14fc80203430924969cbb285c1b3f6788293adc96490be06784d419d226da1b77acd9edfd0ce9f8cb8468967dae92219c2061aff231f56f28e31fb15f8de7c6ab0ea888dec878f182b71ab5d2b0e4d8008f92da865ad02f88bf7652b7000789f0bc2f7b32fd387e3ceab0031047e1d879dcab7ca9ba1e8e2f6218649926a95f6577ccf35814e962d3fb4583599f1bee5b6f4f1551838ab40acc7a38a3c793918b62299d541f696c2aeef25134002ccb7f9b74b4a1b3ee48dcd12dbef8771c233c1c629a6b0dd6fcd95f8782ea4d93b82cf9c9a2fee065061eb80d1b85f5073ce89c101e2fb87af3408a29e3a47c6d83ff5569b3c859cec1e44268edc610789be14734c1ea92997d3627eff4f82aa81be56cc0ce3aae20fc846252221236893f061d30de8e6d12bd9edf8f2f7055e3c4cd64d3ddf11ff173c359211b05f6893f167f97cb8a82a6a2c3cb57782c8fd44937fd85daf5dd3951d0d64d0cc21f8ab0b1ae080b99565033cf2fc037289f71a89ec03678030e90ae614743db3a36dfd80e37d35b40a52f67cdc216a01010219444b91254d55a56c620bce44d299a19e28d7c42bdb11af068480c58d1ddfd3ae46444d8fe008ef93ba6cfdf7620c03c369e9a295001c7ccf44cb11c082887e968cdf503d9b67ff1723640193be66b263b0cf78cbddf96d8b86bf8fea7571b4562789b8e118943ad6a3e325b5d59e5106cb307fa020a10dbcc656989f9d12b47f7fb092f685734ce5cd00898e3407674e9fc16ca91a1939dc1bca3b6ffa78251a2febd2a6ce4d21d2f8cc622ec908aadaf65705afaea635e53c34a80331d0fee8b101423feac1418e6a0fa8c415d54b29589000f891e0f01cfee8bfea917f17702d9fc8a9e549536c7b8a339a25e02bae94568ae3384fd076c32d9ddb179dc586c086fd7d59d3614485add83762df7e6cc92fd31f11d5e4be98d4b72b70e0e621a722056c908913a8927ce6f1fd1e5772ba083b00beb48fd261656d2ffce0298b6134a06d30a1045fc565525a53ec1d74ed09ae86beeafd2c57d8bc362db025971aa4c1cde416a5ae384e621927efaacc0c4a238e230f2afc85930838f6d76a08ff837bc9bc5f869b8ad93288260fd4e74046da39a763e2197ac679b8320d42ea1d3c5b9b98206a9bc89c9bf3cf4aebf3a3f0edb4a256fd56db9b6a9c7590e1ead04cf241344b92542963c384643859bdfc254d61e9135814f0e90ef746c0570980259ce3a374f0b863230ae10dfa1207d200acb090b6752d5a747c2aa0841c7885e19369f437670cab553e4e3b8031b7edb902b626833d8d803a245aff602312eca18c837de46a01cbfda4834c688cf23c87a2be02f68c509a8e7f597bf538e15ebe70bc31a7be76e7d6a220d26adeaa6fdf6954778298803be7d0535c550662c07f2efcdb63566038261c8fd0ce4e4e6fdecf9dde931c2a2efddc80f8fa9ef0105ad9039713a2e469838a6b45fa9bd4f1a2187be5382ecb679b9ab410a4a561c6908476a0a67b067d7c5a371fe571f3ba9607389505abf15a5786116583a1127d5bd20548dd2ca13900503f3ac696ac1b4fec13e3420758abc202609618b8d96e8f1bd3d535f926157a7743ffae0ef7cbeccfb6fddc510c839e930459331442f2a4a77bfeb2896df9bca346324b5e13cf8b91420f2a1da4405358701e3968e3b830f9ed776711a89d28fe3a304a897ca2ec9a1e646d0169e98ae7360263d9b99104318708566208dacd", 0x1000}, {&(0x7f0000001700)="a7a4cc37e9a1a80b011d81a385b2babd97f19e306c5cc227d9c61d2e141f3332dac1cf91939f40d1bf22ee35ef528d6fb7f0f670744b5f27f2", 0x39}], 0x8, &(0x7f00000017c0)=ANY=[@ANYBLOB="600000000000000016020000050000006f85fd08910f491dea98f431b9f5eda12e19936b741742609ed3d3de3ab387e7447d8b987b63ec4f3ab4e33fbd70ad000f50ae5ca0eaf51473d9b13442394717a5cf96309719a87269dd91320000000048000000000000000600000067000000b74f74ed8e32aa5041982b33268867d7677719a81e92634f4427b732df584ad1fb096508635819d614362f5fc2ccc58ea27e460703d8bd00e00000000000000001000000040000007c0291ac2045fa875409a13fd03d935425648df36bf531156babba3eb4c23e7d83bc7d57f8ca29561f2aaecb5396df730ec9d6e1d3ed3aee4fdf583223824665674758536e1e9355ecad711d171c243bc1edebda739ff6fca92c7e13324d56b442d63d266e6acfd730cc1769088d40769dcddaedf785f12a19f4dc72e687cbb66bd4dc010c5242a790d9129a70f2a6b7ff0bf9fbc983563693ec6a6719427f6b65e2e11b3e68a89e00600836a38108b7584335bead7e41b379c0384913ffe1a134452dcc925ace15cdc789a4bf6a69b268000000000000000c01000005000000c23b5e1d6d8359d2712e2ff7e6f056a41304e5a127fd9c436559a393df6cc0517e4cd5b00795fb29080a646ed6605165f523d96718f9f7927c08ef1ff3097e1ff570f6cd1ae460a80220f8c42945575d506100000000000040000000000000000b0100000900000016876aefb53f0d62c0fd174e1c2f51f227a3d10710511f9aea580e0470568d9e691cd18f9a0c3b7b8926a40000000000b0000000000000000f0100007f0000003ba3b8bc1da467cba71274a368b5b812148e5ef741528ca8b41de2c9496139350e6192d499e8fb343f2c0477216db1da42b2c8a535fb4c88393a462c0460b5c74035bb1a0cf7d1f6dcb816f6f9ad63ce5ba8eebaa219e746faedc7b08252489230e97a9565ff22b93388e8a8393ca0e61f093d859c06a3cfad960c4dccce2527ad5821669990e1dc2f06379eb344fefafa1400afd0859fa0ba38af000000000040000000000000000c01000002000000065334d4dad75971aebfe7101f676ee420aeb340618c35b1457dd8cd3592fe09c79484470850fd8a3da8ac8bae00000018000000000000001100000087ab00009b053e431f000000f00000000000000000000000070000000da334206b675a9fb0919b8825be2673ce6a4aced0af8a329ee3c9428b6e7b7079e572d9b827743a749c31f4fe319e5233084ff2879c27ce232679e2a36cc2217b85bb7b73c8da2ced571ac89419b2e83f85ceff7d73b6910f6eeb7e35e372aa1793031df478925732653cc5b3e9e20e63b5f10fd146bc9490106d372406bc8cf438cf5ee7554e71670c75fcdb19c2bbd30600000000000000d02625e329f9b734e768a719bd0348b5ce4a85ce0697a7e9e87f03b16d43e48f331ee16db2703b3afc96d6e94e2b55f999ad02e9a79ee2156d2950c3dd345e2be600000000000058000000000000001701000006000000518f656f38f78b6b385ff5108f234ad3894ac2934d836419e0009e361687320d3100684c29b763c45bbc84fefee70b4c1a62f9d6a89fb08f91a4de1be4c53864b331588d52000000"], 0x480}, 0x8000) pipe2(&(0x7f0000001c80)={0xffffffffffffffff}, 0x84000) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001d00), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r3, &(0x7f0000001e00)={&(0x7f0000001cc0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001dc0)={&(0x7f0000001d40)={0x60, r4, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x81}, @ETHTOOL_A_LINKINFO_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}]}, 0x60}}, 0x4000000) keyctl$set_reqkey_keyring(0xe, 0x1) clone(0xa0018000, &(0x7f00000000c0)="c501b7472292e16f31d1e056081bb6e678fb88664018d3abb98709fcf91bfcaefb1cfa1e79f85406e01b124147f4bfcb39c5c01068f3d7f753f968ac086f49fb37f0a946b42721f51ab559e5", &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="d6bd1375fadd7d3f19cdffa13c1387045e07bd8bb079f2c612151653abd4f1e3b267bab15810cb3bd73178f5aeddc918e1c73599cc0839feab8d20b7bf8b529d2ec2a5c6d3f175ab3cf329333c7b277bfbb17d91a0ee6ec5071d9f41e4e0a0a71a439a1af2bc73a0a6d0af8882d23b94561c68d648d11260cb51ec837b242138bbba77e2bca46f4ae255eaba99ad70f3b8e8596239a3038928dfba7d3bebda3ad7b5e218f4e44e42a30492383d6f63d610227f76b686f32189fb2c9789f0389e88bc52c59b2e2458b59289109e1a9b98e966b0b0ff0af720bad306d4724f6d2d2aa2f7be2d19e85882266c11440832fe78ce025665710f07654ae009068b") keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:19 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:19 executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:19 executing program 2: syz_read_part_table(0xb20f000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:19 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)="febc5867f7ed344ecbc1fc039ea2881b73dc536077d4895f46a387501821507d5ae0bd3f3eaebfefcf629a06ba526ac6b870e90744f4d54c6775530ebe44822b6e1ccf0d0b633147c97218e338b5b3d65fde45ba82d65427f9dc0a79aa5b9ac190924b8152fd0bdcfcb7fd2534350b481fbd3d9228ce79d54d8becbe083479b3c060165c06241e08b1d1b35d7635eded40187dcd34eff9b1cc3a78e8a2c60b9aae04131e35", 0xa5}, {&(0x7f00000003c0)="a606f8cc016230eb01c2adf23b115522f8eb9aded6979288996f2809f7c09e946c4e0afde502eb20dd946566c7a8ba55cc061f84b91decd09eda5353e939c01323da99447e526933ceb1b4756a587cea4838b7e92cd79094ce70c704a787877691cb90a55dbcc6f7ef9ef90b234387a5154ee38c0eb6505bcf9c", 0x7a}, {&(0x7f0000000440)="7c447182ef054a77b9cb5f516decc00d5adbf17f821e8f911458674075f60bb7e868bede8896fbe62f08fe2488e760939337332a3f6eeca79cd2a857141ec2c32e23ea9e412d4ab8b30978735dc2e62c71bc0d0782efbe6d47b9274d5486b049889fa20584cb4eb1f9592f4cee0c7c9b9764dd4a0f78f077feee1ef934575db2ea64aae120ca62d88e641cab83dc12baf07a4a0adfc08d269279825613046d70e1b1d5fc836de43d73a7e787353d3ae918ee1940a5f152795d02e42a82ecc5784f529c320021c9ce62e8aab0a97f41beb9a689913547", 0xd6}, {&(0x7f0000000540)="acaf6340c1cbbd428698c885784f6ba1b19716ac85ec73b324de718b8725fc07675745f01ff4312a261993525af578dab5f317b06956120c213a3299349d4e3b56f4de89", 0x44}, {&(0x7f00000005c0)="ea85e84df7195c8e0a8cb0e340fe70d8f5977dfca59c9c2d35d406ba", 0x1c}], 0x5, &(0x7f0000000680)=ANY=[@ANYBLOB="5800000000000000010000000080000084ab7595964d8d698d2592456c09306459319d0095eb618c70a288aa10d70d7197375ccba41ed50717941a8a933325c74c1cfc17dfccde2d4f63f3b0a62bd44efd3eeeda330000001800000000000000ff0000008af800002e0fc6cd77000000a8000000000000001001000000000000a62d3beab6ff60e8417619b72767479d92445e07209febf3026788664b42fda85021b472001ed7aae9c490dafc96aec3c7b5538f334d9089014844d230ad721132fcdd12647e8463634ee7fe294a073fb67dac1148902d7c886d28e82845ebab56e79cec80f31fb2d7141364ab54ce6a04538fd31f4414cbddb3f0b86f24a692fe935c99d5ce2005e045331e9f5a20aa44a6f85f0000000028000000000000008e01000000000000dbbe1058937009ff376981d245f1aa5b70dc0000000000006000000000000000c623e97509000000e78e4313b30cdcb390ad5479ba9b324a50337d8fab1700096dbe4f9a4d78d32c621c00b20857f1b09fb4365229c8ecc35370dd319fcbd3d5f9f2c6723d7b5929eec644efb6db8dbb842c37f270000000"], 0x1a0}, 0x40011) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) r1 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f0000000100)='asymmetric\x00', &(0x7f0000000180)=@keyring) add_key$user(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000001140)="e9d7cb19b0aca9debfe5a57518b830a1562c950f26a6d0d7e4d5de67c810a9c13f383a9c84ffa0097e8d88389a6e107e57cc4c9bc0946ace3aa58e6c11376aaf13afb41dfdeb8e6c0e8e89656407ceaa4380187c2aaac20bdacc36e690f7833ee0455158bacda6fc8163f224a747c565e4bdced1a19f6d236aebee5a36bc5af7b40bff470052124290af7aba7953b37036db933d388a0665accf69ee6ed7bd59457cb1266a9677f8248f42527e7d36e896de43ebe94a3f95b90c5cf6b2652c4b1807aa59c1632325f40f85a678413f9d716e551c0d4dd08d07f59299cf2773df8d0563467ae00f7e91111aab170bb630472e1298d4f6bec7d5c8b7c1303ccf49f00f181d2354aa93d11e09affba1151a4a134029832a8740f8af4e78f49bb23e88aa9b12cd89beba1e7ee9fde6f705a764f80b1e641a27b40c8a47f345b6e8e8115ff3c6e15f22d64ea10d79782804c84008f27bd5a45bf598f0fbc3811f18fd4abc5b8232d65f4595cc6bce01939ad55b4667966452bc26bd1111062134d0e986a84b9f5b44f9634f518f630b82813bec2a42f690472145e8cd8d183e33f8f6128d52b469dadca8c7118d2522895fa4b2e44c4306342ce970aff267308157208af59d32774aaf5f0cdf0ecc630d7ee1cc34f29d69dd9cd0c6d6a490272367ed1c201e769ef57bd0f04380a17c816f128cf33f8cd7c4b27d7490f8eaa7e627ae4b6f36b44e0d21e9ddbb0c8cd649967067bf80f0852464c19653c1002f7ec6806c0de875c9a474c1177715c3c399a33335f468c9deb1c59dd1d3b88958654a27e09ca22544a98dcb645d4fb50159a7142b5115a33779d89228d5aea700ed97f1ee5c8c97ee1c90d3a7c5e8d42f913ae9fae60806d504a56b85933bdedad4f0cfffc1cca515dd5ea2e1c83bb7c14dd90c6c7c631362004481096d0fa7fbb9cc5bf44ef0ef2b4da5956a72cd83ad0b6ade870a109094af2b356294b789a6867c834cf9aab227c402fe8b0f1c16d11c6fb157465095e6834af75f5ff2515c1288385a1fe862d44471d90951dd0a3cf78c555cf4de78bc1aa6a23b87ba79c50cc3c190092a2722b6079e66bfcf8da3b4421d61b09b82cc56b77bab41de3280e5ce3ce8a9ff1d62f37981cee4244e0825115f4f9380c802cf08ba3cf8879355d5b44f4a41ab99110cc35e72c8927f5f211c0c581c6ceb1554c2aaefb908e3861f63560fcc672fee4bb90116535ca613455880672f543be667102b85e64e926f415fc3a8b50587f0d3eb9c702cf833e9f8380bf7b4cd57ec0923148ac9da9aab872e392f42ca0420dc796c86d1ae1899778f70b7eae6e0eaeecec5ad67bc89de303e403dcca0dcfc63b1bfcf38f0fef13deace4072b7bbc32de536ce7596c4617177b4aaba96a1254a8fcc789a4b1d9453a3cf5a9f07b5f0ed8439e481241c3e35ed9fe2aea8485298c36eb3c8acdc0224b076a6dd4c315b4f9f774d5827000ffad5cc13ffe313cd7cb5c45bba0d4240ffc69b71da4769fbfec4405772744b716f132e806e091fbd7ea0f8fdbc990415c4e740438ace835ec38938ee6ab33a6587d0677b8fd1baf9373e9f66fc45de2c1c8fcb168fbdec53520c5055d7538c25d9c6c48d50a41ee05a2828a39aa9122b137595b8117fe338b571bd7029b65099342019a799d912007ad58772d97fdbf4529b598b44e6027ef96ea2423479ae0631687dcd4382d5fd7bc2768b963ceb1b191a392746d276e1a1cf36530a16cad2e20cea900c17cc9821cfc7ff0a2d57113b7ee3300ecef9a269cb983a884247d660ae971e4a8e33029683efabb104d228a81474aaf33f3df87ece26036b5252627ea7fc70508f74f55e4d2b87696ff81c7fac2c136394c997177315234e0b6954c83720ba5a3d1bad6cd7cd91357db143fec56f235ee7c53a6421db80b8355e10d88678496eb1f1396562eff8bdf856eea8a5311817129d11b0b3e9e0452fc6c4fb59787415ad1fe0cdd3db3479255cb2363916580e18a7ede81564202b2effe7df63c0d663aa91effb13e38602a81671b54079351385ee66c225c4417abc06fb58a8ab26f274d44d37fb85f59eda8cf45eb1cfac217e683c0ea7475cda29ac2c7adcc2ee2ccdc249cd3d40634b3e00c20bed039e5d6304d5bb365a90d9a4d8df4074ad25fb13eed51cd6516ae8a0dbbe66d06682042b7922d15b3157683ae30366e951404ad03ba0a93e9d5ef369448f4d4ce86f270c52a1db941ca11d2dd16a933357e7a905b91426e3ecb06f6b9fbcf79891c0c2102e0832a6bb4eb652bbe6309da81ecba73a5efdd2d4a32c953783c14f2c55969f0d40d9ddaf481fbe0751c374b930fb2bdf1ac7750ea3ee876fc58b96ca53bb7ea81ea40e2b4ea8c597ccc565b984622dd6268de11320ba3043c4cf20a74aa5e609557934024d393c0d9e411dbc0806ce7e25a4628bc18658e9238b23be3ae4dfc8275a87505d492b0065ba233f20513f5ec364364ae206ec55c0a21094d46e0f0577ba8bad691a9cd734e224959d7870647eaa43a8330fb5992a7b9afff20bfd91e844be1886e396a70d26e39ea904da28f4e447e7c7935355fd1d9f109712c0b2dd6fe091a874bd3b269c38dcf487f3a47471a29426ce753f0ce8766465b5a2a822dfbf1d74f2b642ff6b8fb6dc4ef512c48b21516d53887a63faa4479c5e099fb82c23d540f67ff8b52bbdbf7de40a956b8e046418b817da86fdf0881cc5c4c2f68edc985cae58dc37fdab512591d72c15f572a060cb5a0895913588186c28673a476861cc5619401c4a486a15fb961f6fb7692cc046902ab6437335d41ba4e02fd88e43d0f04d1de57c0398d4e704c096fb35bcc983a5dd379fd17c4d38f92d46d9c957761105d4352462e6f87fffff018b9e11b011310d8d755b5aa92366d727a36f8423f016b0f1d326c0f266df4bc8e3c9b3b661708b06bef690bf276c16369b2ca3c1f14080d0d9e08e3d65d50a7f1ab044dde6748047149fd73a588bc860abcb336ecba6557f80959b6078a478c4f8312a0615ce74a8d0d111bb07c817e420bc78b9a7378ce14d4ce5926c9aa948f6ca81c9a93a0f4602132de78937ac7000aba6814689826dba54d732227ed9e9da7a8c07c84d15d3d08f6c1335bfe05fbbb1c056b286403833395454bfa686650d1c0c8d618d9c026c779d00b409d6f84c66b14b7e4de1ee2afca330fffabfa7a4e73131585f13a87c47565453902264a42683658e1a71a39c5855de7b0f1fba27ecea11a654c9a355cbac8cde885478358dec4bec1fcf4faa31646178a28c7c892f300b7cda393b159161a5d22f07a5503327fce161d6462afd16e2ff862f7b6de60ea9ad460022e06eb5fc4c6b4dc40bc8195e79bea9636ba93d4faabd0a73a454ff432364d0d01a8087a75e098cbc8210b70d9cbcdb9b8c6e7b159530bcfc2b07840c0dfd34aa815ee4f8521f7719288873f687e561ab7edf08b4da2eac351395d274f786956ae41fba8dd5caa0b9a8f7ee7fbe0a4c8063866bbb0948836c800d1f14df2dea3bdd7bd5b25d5e5eb389e35c020c5a43c7c02bf5820b4a7465fdb17f6a6358d4dfdfb31968f5c1f14e843d44df8a34971054cd6ce82c80a518d744874fbf96b003d82570c206e34a662289b9402be77114ebbfe0a822fef70be1624d32db17d512c2e0057f0658d1650acd00205999bfb63fad6649a992c502da0dfcaaa1bf987517a64b4fdb2ccc0844c45c1fae827c2484c76634fb4c6cd8631c782a8f874b1ebfc55260b682e4aee22977ef59d456a3f7da73f187a9d26f8635c7187e28c299921c2ea282ab665828cec8754c8dce0d8a0f9b4acd5c9f92c96c665a6b072c754b551a6040a38f58e946039d1a4c061600807f32314d8e99ead2fd034d33b21d5275417383212ca329f8c7c74b6b0e3788c20e424c07a7557e0bac063c1ca046dbed137ebab7ba7510a333c5f3e5c68e34b6e53be7ceabcbc811450d2c9f0867a0c0e1a2a70cdf61c9979b3ad5ffcfe43c2c7930688d4857822f161acec8e9de8b89c095b1f8f7437293adcc80bd06000f6610057ac500764d3bff58806c413bfd9602bad9cbf769285e728bc4136234cd6d84c65efae7f4f52ed603747826d1f0315345bc50c4a2664f67654a5fd7f6502426cb0242fe6edd1235f3c9920f6b355980451d8e4e23a2ad31a979546eec97a9fe2e28b127d33e367876bc4db0af7c400ce7b51a21aa5be3cbe018146b981e88a5c51e4a1633ace8892602eb1c20978827dd3cbd0a11aaa2e09ac029ce3e8bcd8bd6a33f1d57abad05d4c47f158f956dba6062c421d0def10133eb9dc71e25e3a1edad67d4ce0ae2182a4c8950aaadee44ba06888753c2b790031779206bee0b7bebea2b795f6ee9ac7a67c03bac5f12dfd78fc741d13bde312375128fa90a800ccbdf265df4f5f1fd1124549de5b329cf06c66b1384b3921a898c187d95096a7e2f3a7fe3ceadb0ae312175163b593e2f8ba9a9600a7dae6f01eae68c1291d0d97543b35ca604b481437c1f7199d656a32d23d3a8083bdd338e8c89484f199ca229d8e29029309f57d36812ca8593e2f9da5af5ba6b989b5627f838723577e374083322f384c7d30e5b6764332a5e71e85b4702f8f85d23d7e2fb588f14fb0a76ae860f2d904671bb5fc282c3615bba700d820a98462673235162938da09f30b788bd0156eb3c444c6c3b181312743f44e2903cbfbd140d803276529f512a2d21750895217226c0bade36ca9772e0307ffe0c16cfa25835b0f7e676f7c46f6d552cdf361cbfdce7e46e3f15586a971dffc6839a9b6e9828b7f1f7eae3d19c9964b6d57236dc96f89f472894801e56ea0c263b19e0ad6648ea8431f0595368d36f9718f200e23994c93dc9d4c4189b52658b6e3af7ce39b280020182208100e75b1df2234af5433a35b4fbcec446e51b567cf5cf4cb988a22a1ce7cb4698f217a957d442eab09a6e9ecb9f1e0a6266cb283058f8c45ad32e3958ba3f5b844e853cea9e4570d50b9217a1750bc4c56d7b50943dd532cf3e781a35b3316f5a0a5ae899bfa9ded67d9ee9e09e134309e0ab186ca3deacb1ce08246481a6b0319a1904622ca7706ba69d34831e937237d9510a5d3312a6cb15075b7a07050922406c07233e2a6e7a505d0a7477fb068d312aceb7f00106fbb1de1bd00c06337e4e390aac2d5868a650b053037a479591c0e0536b3f5dc5f99327fbb6c148006e29d1d5f651b4794e9612c352446c9cb96648abfe5e59c43cc16ab83e4f597ece99a81e44b1cc2fedbf37c4a5569e68d3aacfee228906a8fd885ec4c2cc7964ceb1644a90fbd99ef96936d34b91fd07a0d622a35200354c685e097089b12c319c3240416ce4b49ec90f5572b5782cd832daf2b260be464dacb33f21a42abd5add6110a52876cdfe636e954c83477db6023d0334428f7a157772d3c6e2181048baed54b34c8e96637385dd638cc9b5d10fa382754c6425a0cd8f7d802fdbada86d415000916d60a2ed3dd1661dfccb6664dcb17a892ed67094ee74af6d08049ca5bee9b28bb946ec433ffd4b57e91f19a8bd921b9be9ed167cb3d1e3c9561a98bfbee2555b0061d0ecb94e05328158bbe19fa9d0e20d2157d2844709a9c83c310c27bc748b357b19a124a6d9f753a8c415eb986ea1de4d3ac8157729bb903a70046c0f86c394bfe23ef627a6ec564d97bab8bd8a86aadc87044254ba053ceb51707446b9bb45011785fd28473a5d7644ccee98cbafa7dc83d8", 0xff5, 0xffffffffffffffff) request_key(&(0x7f0000000140)='blacklist\x00', &(0x7f00000001c0)={'syz', 0x1}, &(0x7f0000000200)='asymmetric\x00', 0xfffffffffffffffc) [ 356.437787][T31470] loop2: detected capacity change from 0 to 264192 [ 356.527345][T31470] loop2: p1 p2 p3 p4 [ 356.532982][T31470] loop2: p1 size 78398975 extends beyond EOD, truncated 11:03:19 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x80) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) keyctl$set_reqkey_keyring(0xe, 0x4) [ 356.621247][T31470] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:03:19 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) keyctl$set_reqkey_keyring(0xe, 0x0) [ 356.694535][T31470] loop2: p3 start 2127165541 is beyond EOD, truncated [ 356.701485][T31470] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:19 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, 0xffffffffffffffff) 11:03:19 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:03:19 executing program 2: syz_read_part_table(0xb30f000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:19 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) r0 = request_key(&(0x7f0000000140)='dns_resolver\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000001c0)=':\x00', 0xfffffffffffffff9) request_key(&(0x7f0000000100)='cifs.spnego\x00', &(0x7f00000000c0), &(0x7f0000000000)='\x7f\x01\x9d\x98\x06\x04\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x1b\x1c\xed\x00\x00\x00\x00\x00\r6\\\xb1y\\\xae\x7f\xf8\x9chOO\xa8\x1d\xbc\xd5\xe22\x9eS\x98TL\xe6\xe4\xb6\xb6\a\xa6\x96\xb7Z\x1c>\xde\xb5\xd0\xb2G\x02\xc0Kr\xb4\xc4\xa8\xb9>I\xac\xcd+,y\x8d0\xbfEU,\x00\x00\xb0\xcb\xdf\xca\x05\xbeX\xd7\xd8\xb2\x97\xff\x96\xc0\x7f\xd51\xf9\xa2[Y,E\xf4\xf0qr\x1d\x00XDw\x82\x9d\xd7\x8b\xe3\xa4\x13\x18\xb7\xca&\x9592\x90Rl\xf9\xfa\xbb\xf04\xcd\xa1\x14\x89\xa4:\xc5\x83\x82e', r0) 11:03:20 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) keyctl$set_reqkey_keyring(0xe, 0x7) 11:03:20 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000007, 0x13, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(0x0, r0, &(0x7f0000000000)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)="412077b47ad3da098ea7a76baf7a2fb86d1eddc4a53accd28cf77b7574d366a327a376dc5347a0505335a0c4836bcce3028fbf558da064f024c572bda71912463bf9dac4dbff8be59bcde3fae166d3a89c5c408998d57fa35e45f6ea3f73526892716658df89660de21710fac45df31d3c61027866289f8317378ffcce1557042a409322653e15", 0x3f, 0x0, 0x1}, 0xfffffffe) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000080)) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 357.064074][T31524] loop2: detected capacity change from 0 to 264192 [ 357.115657][T31524] loop2: p1 p2 p3 p4 [ 357.125022][T31524] loop2: p1 size 78398975 extends beyond EOD, truncated [ 357.155451][T31524] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:03:20 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:03:20 executing program 4: iopl(0x3) sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x7) keyctl$set_reqkey_keyring(0xe, 0x2) r0 = add_key$keyring(&(0x7f0000000080), &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r0) request_key(&(0x7f0000000000)='big_key\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', r1) r2 = request_key(&(0x7f0000000140)='id_legacy\x00', &(0x7f0000000180)={'syz', 0x3}, &(0x7f00000001c0)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00', r0) keyctl$invalidate(0x15, r2) ptrace$setopts(0x4206, 0x0, 0x97, 0x100008) [ 357.184363][T31524] loop2: p3 start 2127165541 is beyond EOD, truncated [ 357.191366][T31524] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 357.363442][T31524] __loop_clr_fd: partition scan of loop2 failed (rc=-16) [ 357.365506][T31559] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 357.388495][T31535] blk_update_request: I/O error, dev loop2, sector 263946 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 357.400787][T31532] blk_update_request: I/O error, dev loop2, sector 263946 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 357.400877][ T616] blk_update_request: I/O error, dev loop2, sector 263948 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 357.413510][T31532] Buffer I/O error on dev loop2p1, logical block 131968, async page read [ 357.413541][T31532] blk_update_request: I/O error, dev loop2, sector 264064 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 357.422938][T31524] loop2: detected capacity change from 0 to 264192 [ 357.425148][ T616] Buffer I/O error on dev loop2p1, logical block 131969, async page read [ 357.495272][T31524] loop_reread_partitions: partition scan of loop2 () failed (rc=-16) [ 357.577015][ T1033] loop2: p1 p2 p3 p4 [ 357.590462][ T1033] loop2: p1 size 78398975 extends beyond EOD, truncated [ 357.622656][ T1033] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 357.653063][ T1033] loop2: p3 start 2127165541 is beyond EOD, truncated [ 357.659906][ T1033] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:20 executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:20 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000000)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) add_key(&(0x7f0000000040)='encrypted\x00', &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff8) 11:03:20 executing program 2: syz_read_part_table(0xb40f000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:20 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x5) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:20 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, 0xffffffffffffffff) [ 357.847252][T31513] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 357.855833][T31513] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 357.885619][T31513] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 357.894260][T31513] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 357.905582][T31588] loop2: detected capacity change from 0 to 264192 [ 357.964042][T31588] loop2: p1 p2 p3 p4 [ 357.972319][T31588] loop2: p1 size 78398975 extends beyond EOD, truncated [ 358.012340][T31588] loop2: p2 size 1073872896 extends beyond EOD, truncated 11:03:21 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r2, r3) 11:03:21 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x88014500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 358.052780][T31588] loop2: p3 start 2127165541 is beyond EOD, truncated [ 358.059769][T31588] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:21 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x4810) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) clone(0xa000000, &(0x7f0000000480)="45f43e76e5dc5e3b0ba12524e1dcfaa250bfad64b5e2e1fd8aff0db656e219098d868150d15945864e14f24ccc2dfac3fec53e6824572821c5172e1b10573226e084200a52e947a082b457250d0e592835186c7d1e9157cdabf6bec8b63907a91cbd855a18e5cb9ffb0960eb6bdaa836ac179981d982e07b1d790782cd003c7dc79465a49b935f1f1eada4d7878cbad500ff33a22829755b", &(0x7f0000000080), &(0x7f00000001c0), &(0x7f0000000200)="cd473e67b94166f86ff7fe92e9ebba288088d7e900c817a2b6e81399900430e9ce781bdcd7231a6d23929b807e597d16b1f0") ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) wait4(r0, &(0x7f0000000440), 0x2, &(0x7f0000000380)) clone(0x804000, &(0x7f0000000600)="ee1ab9cc02db8f1c140ac5e3862c00340a3dcb71f71dc9d758ffe4a611aab194c06010c08d48056e1a0ba8191182a82173c978e705b21b193f8ecd0e563e44a96d5d528ff4b852ecab49656e2b5d586207ba6c77a173949eeb900abafac04f6532516f6b03a65389bf25af67e2f31b546af76d11b78db04fbb9e79edd87aa006d53604018bb91cf4718322a8af647d36c9dbe6ef897c9b9c5db75371fcdc45844d9578f947753ade0453293cc840601e534fe6f61cae78fe2896bcd8104ebc5cf460352ec2c434b334f224168dd476698eea8300004a76bff23fca54d3693b7033685dc9247a671826e3f0333f4d27ec12cbbd9eb1b64e97d9fb80067333e5eab33b5f51a006425f9036470384d4b57e8e359832046faff44b027d85bdc4ac08093e6ed2a515d105296d30c8a3580fdb5aafb740e3628c9efa94ff2565497d3de9ee", &(0x7f0000000000), &(0x7f0000000340), &(0x7f0000000240)="8cbd10616186c822f0c958ec4d5ac8f8612c30361e5b8cac6553d9d1880a81b51451992ac853b4e4276c7564ddeb7ef1f20ce37afff2e4918e038508cbfd52977c57e978030aef78328b9036aeae40bac41aa647d69d877f6b5c88b712a90fff12110dd0b2e43d4b394f385413a58a8127e155dfc9bc8448b5a1afdaa7ecf9190f564039a027bd0137e1781e643ad5df21215cbea8171eb5ed0674a561cad77650e0d9fefa75da832e88f3322ef74227f2a5226e5a5b2f00ad2d08c3f5ae56e73f56") r1 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) process_vm_writev(r0, &(0x7f0000000580)=[{&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000001780)=""/220, 0xdc}, {&(0x7f0000001880)=""/4096, 0x1000}, {&(0x7f0000000540)=""/50, 0x32}], 0x4, &(0x7f0000002880)=[{&(0x7f00000005c0)=""/13, 0xd}], 0x1, 0x0) request_key(&(0x7f0000000180)='dns_resolver\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', r1) keyctl$set_reqkey_keyring(0xe, 0x4) 11:03:21 executing program 2: syz_read_part_table(0xb502000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:21 executing program 4: write(0xffffffffffffffff, &(0x7f0000000200)="cd7feedc5bae7f286408a5b8ea1522c5f3ac1ced5efdab859721fa4a5dfd2f9d98acb73a6329a0e8817dbf750ea6665fec0399eacc291d9f524808b8566cbbad2a82c174ee1c0d53a45970362489ea8d045fa9c99de196f1300118a3db6722bab7718ba38304d3e2ec0bf384610074a77abd82eafc7fb9cd855d8c83b9ab984914369f3951f2160b6d8d6765b8fd79ae9b08f44057ba59474e58f247752c0f3376e5", 0xa2) sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_io_uring_setup(0x3177, &(0x7f0000000040), &(0x7f0000000000/0x8000)=nil, &(0x7f0000006000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) fsetxattr$security_ima(r0, &(0x7f0000000300), &(0x7f0000000340)=@sha1={0x1, "cba26a0fa65defc98e3be49839ec09550a2d8507"}, 0x15, 0x0) io_uring_enter(r0, 0x0, 0x1b90, 0x3, &(0x7f00000000c0)={[0x3]}, 0x8) pipe(&(0x7f00000002c0)) io_uring_enter(r0, 0x6d41, 0x0, 0x0, 0x0, 0x0) splice(r0, &(0x7f0000000040)=0x401, 0xffffffffffffffff, &(0x7f0000000080)=0x9, 0x6, 0x2) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000000)='asymmetric\x00', &(0x7f00000000c0), &(0x7f0000000100)='\xe0\x10MU\x1d7%\x02lt\x9d\x7f\x00\x9d\x98M\x00\a\xe3\x7fs\x00\x00\xa05\xe9?v\xdc\xdd\x0fe\xfaeC\xb5F\xee\xda\xc1\xd6\x9eV^xX\xf1\xaaN\"\xde\xae\x8cX\xe4\xc0\x8d\xe1\xb1\x0e\xf6\x92\x81\xf9\xd27[\x0e4\xc8Ds\x16\xa2Z\x91y\xbcg^\xd8\xce\x9d\xa6\xc4v\xf1\xd5\x9b\x104\x0e\xe2\x8dZ\xaeb\x1b`\xa5\x0e\x81s\xf0\x86`\x13\xc1\xffC\xff\xfa\xa8\xff\x15px\xd5B\a\x92_\xb7\xc9\xd1=Q\xf2\tv.~1(ihl\xde\x02\xca\xee\x97\xf9\xa9^%\x81\x17\x0f\xe5\x93\xe3\xf1\x8f\xce\xcbZ{\x8fL~\x9c(\xd9\x1d\x10\x82\xccgc\x9e#\xe8\xae\xc8\xe2\xae~]4\xbd\xc9`.\xd0~\xa6\xfd\"\xe6\xe3\xccc\x00', 0xfffffffffffffffe) [ 358.323289][T31632] loop2: detected capacity change from 0 to 264192 [ 358.354779][T31632] loop2: p1 p2 p3 p4 [ 358.359420][T31632] loop2: p1 size 78398975 extends beyond EOD, truncated [ 358.398735][T31632] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 358.445530][T31632] loop2: p3 start 2127165541 is beyond EOD, truncated [ 358.452747][T31632] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:21 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:03:21 executing program 2: syz_read_part_table(0xb50f000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 358.624959][T31656] loop2: detected capacity change from 0 to 264192 [ 358.674492][T31656] loop2: p1 p2 p3 p4 [ 358.678934][T31656] loop2: p1 size 78398975 extends beyond EOD, truncated [ 358.694390][T31656] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 358.730609][T31656] loop2: p3 start 2127165541 is beyond EOD, truncated [ 358.737619][T31656] loop2: p4 size 3657465856 extends beyond EOD, truncated [ 358.894845][T31602] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 358.903501][T31602] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 358.934924][T31602] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 11:03:21 executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) setrlimit(0xc, &(0x7f0000000040)={0x4, 0xfffffffffffffff9}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:21 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r0, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:03:21 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:21 executing program 2: syz_read_part_table(0xb60f000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 358.943583][T31602] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:22 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) [ 359.079776][T31681] loop2: detected capacity change from 0 to 264192 [ 359.249728][T31686] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 359.258635][T31686] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 359.291587][T31686] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 359.300239][T31686] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 359.348549][T31681] loop2: p1 p2 p3 p4 [ 359.361479][T31681] loop2: p1 size 78398975 extends beyond EOD, truncated [ 359.370873][T31681] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 359.380393][T31681] loop2: p3 start 2127165541 is beyond EOD, truncated [ 359.387260][T31681] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:22 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:22 executing program 2: syz_read_part_table(0xc9ffffff00000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) 11:03:22 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x200) clone(0x80, &(0x7f0000000140)="16d3a19924a2e20e38d8e78211c6dcea3606ad071ddece03f09440092f019657e8a5e0e2b40d78022be598d4788d904d525fc904e070fbcd9d6299872d34d491646daaa526bdfdae2f851269ed73dd570eeae289d94d3c6e7449dfce1f7d", &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000001c0)="ae6b218f9c57fceca306dcbcf6b088976b2427f732598ccd8d1209ad68bdb367b6b8554a594181b1fd9f516d0c14d676f0c1d198bafb104f2327e6a66a384f75221d0c9a6500a1b459d5d3a137a9b02c72595f5f5b2679270102e0126d87bf3471c2c10315a5274403b4c462cb9ad171cc153953ff04766d336408c8") keyctl$set_reqkey_keyring(0xe, 0x1) r0 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000100)='asymmetric\x00', &(0x7f0000000180)=@keyring) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000240)='\x7f\x00\x9d\x98\x06\x00\xe1\x0f5]8*\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', r0) 11:03:22 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) setrlimit(0x0, &(0x7f0000000040)={0x4}) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) 11:03:22 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) r0 = syz_io_uring_setup(0x3177, &(0x7f0000000040), &(0x7f0000000000/0x8000)=nil, &(0x7f0000006000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) io_uring_enter(r0, 0x0, 0x1b90, 0x3, &(0x7f00000000c0)={[0x3]}, 0x8) io_uring_enter(r0, 0x6d41, 0x0, 0x0, 0x0, 0x0) vmsplice(r0, &(0x7f0000001680)=[{&(0x7f0000000140)="61f642c593899be510bbc28b7adbee58724e1e06ba7fed1cc6080eaaaedbfeedd143e31b1c83fe6a013335bca6090683cc0bd2509a89c2f26793ed4362db25b1effbd9d4bac7d6360e244fcd9e65b439323fd74e8cff67dbef94bd0b63f6bdd97bcc22bcc7ee34d53aa3023fac335fce4f0fb5d32354fccac2fc336bb6b8d9dfabac3664d3162866502199c9651dce5cea3d411ffd5f2315069318accb0ab9d37125467d008dfb62c8b21879d7c4a67fde04b30857ab3e6b", 0xb8}, {&(0x7f0000000200)="0c0518aeebaf72396f3fb6764d4f17e87b70a74ed7c55114d8e506b6e290669e1ea2eff01b1c25eb6fe64b4a09b92b9cb9eccd918321847bc980e2a674568e4fd108b1c629aa211a71429daa23fe8e67beb2e8af9b3bd54fb5067afd7bad1d26c2425e54cdf775db3fe269eee7809d16134726fdb2e95dba4de7810713c13a199f6d26e466a2a8f871b7076164f8d7458b31a6b5659cf53d9c6a7a5eb3f489edc4b1361f3844692261281aa8d0617daa28285667ea163f530e4d41512e29162afa3a1d882c555adde8b529b9a6d3a946e2a062887e92091f662e898b70a0eb72d37e29a324ae8439e5b41cb2b57d9e7aa8395b7a50de637db241086052b425a9ffade94514ebb7e4df32f58c33fff6cf84cfa4899cfbdc83850cafdffaeea632139e40b3f0619467027b08baa80a034eb3ba9a794a7c02d4573cd98bb123f5b38efe54d34e4d8c90f5574c8fd048fad438f2193e124a70b3085118eaca5ce6984df373d458e0febb8da10c33d42602c42f03b3971df696dd89aaa4052851bef60c280b03efc53859f8e79473f5003143d7c133c197ad5e3880456e4ce74ab73aca309c5f165cdfbad125065f6e6eb615679f9f8f92876270dde116376ed96f2758042744392efa5a6f924bab53625ed3d10340a1553828ab7871781b2139c1eda8bec514777a6cdeda2e05bf9995efb811383363d56486d3c6e51bf8a24a3baade9ef735f61d012045a175de9af6b76556320db79523a18a08342fbf4e303361853ca88434493241569b34162f1b886f97306d9d9e2ea3b364619e1dc03b22b019be736deb6fc380d5e4373b54633c6f8b53a4d3b1530195e7a195b899f38507d950a104ee8484e0f3bfc86539e1446108f4414b9aa9f5d7a09357eec43bc420661ff3cfb343e106c4d5f5aebf53ed78e2daba8e24744102dadb8e09c98450034c88875d6bb9c7d07b1eef914b76b176edb2e0379aebab94c14c23810c8c957858c5f36d860763a25247cffeb70cef836e7e01da2d97e84742f1995f6c8e7bfd40f8e7a643fd3199627fd3dd14f97e4c1e4f732bb16cb80848548cb8b42282b36947586ba83f86e7fce08eec591ff464d23506e14c35700f6d86f3a407b120b1a074bb3a0df000894031edd592f7761502e8c527173e68986fe026a4b61a8d5beec1d4914b236888688014549b5eb6cbe97538c44c4eed75c1dd458af0790d3b1d7499b8bf6937e1c8dc2ec9b890c20ad67eda3d00cb0809eca39ec354df1358ff48a732ad2e10f852a84efff8c78978da00983e4bb61738429d60a6d2b4067c7636ae08dcb1043759276a5f51c45989f565c799a7dc6dd0229308baed310efe696187381899a63935cd7ff8a80e50c57c0b5d11631de5ed4cf74cf74f7602fcac7a82f19f66f0e12fd6648f5f9ed252be74b97f54a236b1ded0ccba27cc33497dbaae89879027892e4eb3fb276b38e95209d6eaf30aaf63c81317fcc5c8474c68fa793f0f468fe0a1b93146066584f2b4e1151072359b78fab84d0f0f54e41fd4c7fc3ca1831c42c674a0c03aa6d29e942125aaf5d1f72e6e8478b69ed608946ae0aa2ee14d6f321636bbdf80a7df646d2a2b2fdc60f34015f79b7cf9ecf247477f030e86320c5ea521b9cddedc4fab896ce5466050e2755af1c60e3a1b78a2364e6e83ae0f37ec1d79d9b40a0e2491d01a0a605bdd46ecd9efe00452d6cb32d9966ab51d2cbc6090ebf8419c329316f2abac21e20e7047cc8cbc43336c2fb7e470da11544523a9c241a60c4b3deee4d66609a765e168cbbcbddf2e14afa11edb46d125381b72b1cfce621731d84220fb5ef248753225e9d652d0bf88bde490af46765df257ac02aa9811cf08b44cb6cb6ad4a7d6f88dd2d13a189dd58263c5eb9c88590ea3cffdf8cd9561088ea1036e47f3ada8598c6596532d54e3bc593ce6ed8dcde97cb9f40efc70d1d6923adbc971c2f663525cdcb809dbc291a1597fd92865391fdcea337103cd2e747001f42f0ca61a4defca7b3fccc670e86c383d6d5dfe3169c8d94af56e46616df0e761186e13bad29b85f8ca6203ca2e184a410569d3cac993be0fc907b8989414e1a2b1b4d46a812535a8032eae4c21b08a935f9add5950f307c3ef1b8cb50bbce40ab87dae26c76c7e664723e879c151ba641b846fe5586a19c2f2271c31f26d389784a2df7901a5ec9545d78950493fd6ab8282970be21c6b5bb7554a78ced882609b0d57da7ad744f9faf79061450bb1f8304d5c740ec7d9bca836c9783ba8d52139a41cdcfc4455aecec588bc2d3cd71ebe1cd17a3ed0e2bbb44a4f54c01ba6ac45bdd780d899df810726f9359a1ddfa3d543b1d23cf333fe96e950e12815930e60ee39d76fba55e5ecbf12dc835990d6bc2c48489e693191f0e08c0016bb0bcd5e9207f40260f647cf6e25e53876855142c29df40742cd9b2f854284720e7cb76b3198af2bbcd3d3066484b284875c2822b4c25a9d8d84dbc9bdfc8c29705b130045e03eaa326861b5b629c7d0845f1a5926015d36fe599be020d7f387e5e38a7f26e4cbc39f56f3b1d22c6f07bea0122eee58fda5be057c803d192582dd56c8572ea4791a536338e773997ee5fd9066d0761eac1f9e80073ba003db9f34f0875f39f4c1567693967a8864de28ddc6b0680bc954f76ff6247c31dcb995705dd37db16547ad63b9b90d8509d711a4ab56f2bc1ac9d8859b8a1a19f602eae6d3aa0daaea88cacac50538ae8626648bda7fabe848477b3fb84eb382211b6b245cff1eafd9f1a12bcfc8e41d3570bc6ff8f2baeb60f170bb5405443f3ffb7772524fc305b90147641e85a50a48d325cb8e55e0d06bb88b15f045d7d493f823867b8c34c9cf10496808c4a7902de4f961aec871ff764906837d5ecffb1797b7b8e577896ce0d4f8bbf724fee4ea050bd226e9f352f0ae5e82ae1ffa6a6bc184e86151c60259d923db6709ab2e8a3ad50d70b6623488f46d211753537428a53bca0849e37f9de6199d04c82a241ac42d59990c0cce1f4d2c6f3985bd96b9564b60744b534784cbfae4043bfb068126f96b1cdf5614bc486418be700e58fdd8b0940447634a9695a11d7e9581aa7a3c0d9bdf04f8691ef950a4866e3b0227c2ce39ad1423c7c5448cd0ed87133b3f4f5842431a1cf02917c284e683123372f58b621c3daf916c388a503d5c2c3d74da195715279274d7f6f57a62b46ff5ec71e9b9daee4419a8db73e1fadd04eab11651b45d37b87c116d797bf9f9a4349043a0042e0c5b78f379aafdcb4cccf5e04f0e3d0a283a2761e816c65626a941685c138889921b8c011b6a3255b5847e1df048e0108306895df767a8b631c7a7bbb3ab302071fc42723227d582cc0a7d3bf9299ae5616fe4dcd3e47239e4e80217a2aa11e31832f199e3ec8262eb58e906c115eb73a239ac45298aff618479152b03035034730efa8ed69bc751a6e4a8d7e3d540fad5be81f6b5332224ba3685851970fd233e3ded2b7470e33a01f6a0e14f9f94ea151fed1bbdb382f56ab8f0f5d4bfb616c0cb8237d67b7b3df4081c0a839937b80ff9c95b44bd25db577522405fc1ec0123d27dfda2c0bb7f9b63f61c50fcc33885d78c61241a2b2fad5f26051c3badb37be6926db3984943de17d9a44cb398f6e8f8bb696435fe020f8c0cf158c2608ccd2df329a84d344cfc31f2148e28a1dd6a6287448d315b782d8918774077c36d454dd699a75f706c5ec1f48cb41559f99170738c79b5a53452c82115f3b20f126fcd50b8d48edc9738c8d3072274d0fad66a239ff7659aa25d55c4aa8aaa763d3aa593866805f1090db3034f0010740796a796effbf8b31ba51b0d4e12adde89de545b670f5337ea4fde5049b3720909300c5d3a57e4a969f897b0f62cb014df3e5da3b915a1b7bef1703916ef40db956cd588ca9bef3aec4c4d06f4bb179e7f1c59905efc623cbb5c02ef5e4dfaa0f0fa8df0764d474729bb9e8ab8ea89aad85c4c9dd1edf407b343e99f755e5f7ec8cf6b10aa2f387fcc561289ce30afcfd6a67a65f3f4b5725b2f4d01e60aafd8881f4205ea1e23b0e9bbf21d63fd47029022840b62b76e2b387d173a2fc8f5d5fa26c15f4413225869119251382db94466550a63ed367681f20047a9712330bc384d962e39ce9be503417931301babfe6216636b3e0a2aba4f27dc73b5f36bbbf944c4028aed11bb22d0b56eb7fb3131e503d91ac917d17a7f2522560777ac923ff9c3302e4c828d1cd351f5f3f3c455223c22a54027da4794c2e19e710c1823b719eaa2cd4315033c37069b3d1a3f744ea467645f666340e1d1f524eacafb12733d9d5046921e86f6f2e18809cf4b1ddf2ee7b865e6308148205b7fd9587f73bff749685a8470ea716b33df733414753f9451a3e625ab7573d4721d0d686768ded070d5aab11990cad0518d60a7f6b1fb5a9d3fa8aad9a34c4cb10e6d60c1808768afe52f7ce39ed998a31d566a76a850e1b82f12dc5c663780eb369debc5b02d5e1074c8223579907e0c38023483bd896541bfd78603e7e134338ebf59bd8968c59da7f87066a2e8d83f53b42db6d800471a5daae95d7d19e3c54123cc552bc3557666937fbc05cc48473849b987bf020d497b05bd2819c5e5a6591867c4bf2c8c5fc29da5c17da4ea868c281b82555e5cad710bd2341f10ef3b569c4e8f470bf63b565f57197fe6fcde433697a885f0c798055f99ca08d6d4432b3b7bd9554eeb8c22104a909979e0d052ac896d5eb21d9b037efb3c2edbe1a54aceb30faae2151d1c3fd65f98c2c0db66d82506e6843860cfd10cedd5ecccc0b0da5b48e7ac884b148ceff2035eead76af8f70a99dcd40580d3248396e2c237187bb5e93e78bcf2635e4a5c29bc4909ba664dbb9b56a7c404687d9590a8dd80f342b20c0bddcb6b2bdefa37eda3d351978b075b4eabecd0ff5f679b9e20ff136f1ca902b1ffc1a65e71cd42c78fac34fd6fdd10bb80ceb9649c0a00af0514f2b95b7a75bf0c983b834aa0a22b5a3e17d775c36526d690f89eccc86011a4815d3c7f94d77c99225f375f1c8e57f0c55ef251ce80744ae510046e30d199a50952e6bbe32ae87eb3f8c751e226e7db27c9361f00d1fb917091cc49eb91245c5b7e425ec4ad24789dbf684694ff7966e17de3640e285e4e49797c83a2174169b7e4c530d43779232188a661ef93e3c8ce54c97f267927159341b1fbbd703a24b96ab1c3776bca90263d5f05440ef50215a2aa4d902b28d3c95fd9880ac0cffe2f661622ceb59a6bc67d6eb5820d6060fa6be09a396307667a0b13d5b89d833955e1bff84d87e3b75bd2007b43067536c31c69d992515293b8f0b93bce3379477ae2d2e8348d3d1a91428186d284902e124cf4eddf37ff254e5812094e8884608eccd630324ccdec7338f10e336b48eae4d51169366cd7c3b3800921bd9aa83bb50782bea6f943cac14ba4832a369ee2ec419b9f43a22cf5c82ffd847afceccc8280e29de4c0fe88f1322f720b68360fe2e8a75ee0190b80250ecb3a7bb40f69a1381931f4553354899fd8d39d22fd3d48fb1a5dd9592841bc26e8402bf869b70bfa9045587bc713a1b651fb8b57ea1bf50c163b30d61de72b29bc5b4272e9d7a85f705e5c3a0d3ef0e69eafe8a28290d9953e3b28b439d2cc954e7aa258fa2c20aa463be3200f90b18e9802c8bcfb6e11bfdab702e664b8bddca625ffdae8386ddc971fc3d1c90e851b4f0397f8f0c35134491fa3d0e3e5de95abff1b622c6eae058fa7faeb14cb90", 0x1000}, {&(0x7f0000000000)="403b2c57b22658dd8c81f8ba", 0xc}, {&(0x7f0000001200)="58aad18b47fd53f1bb6be76c996911f2d66484295470b2765fcf6279118425e8af84da3cb2d4a69d151502afc5304b7a9e27a6572ae359f5a5020a968e808ffff7d31c0db76d1f683b355cb22edf5d6ee7c9d3a4d5c89489e7b169a018658e0e09a536c7068f2eb7fe87c1d8dc398478cb6712d39081421a9017540d37a46eff3d8db0b34699376adae8544ebaa79470515abbd9cb558b", 0x97}, {&(0x7f00000012c0)="bb8956b76c6941c6290c3a759fc61273a2d85b5a73f73e0d8620c981ea296cb40a36a3d1638a557302e0b5d8c2835122cd778af61de1ea33f5dcfdda1829274aeca4936e5ea45ac467f61f29675617d53d3caa624c4b2d0d7bc326da8ea0c90a01518fd7a44ff0aac4758139711ea5657039538cbdefda5f20084f64662d830cbe7a248a234cc0", 0x87}, {&(0x7f0000001380)="a337429babec0d7c0b5406acba3315084effc9947c4d1528fe1e4355c827ab06e6f7ba8a28f2d0f60ac7719e32621c07f28d7e889ea80c2066aee87f2b82710e5adc4a5230e1f5336163091139404419b4472bcefaa1b4b6a00c3609f2c753df551163dffe5115dcfe6ad4e10ba5c3bf962f40964af4f4d574c973cfec056a247b036fbdb8d4bb1012f690400764c466553690fc9f6c9be3958243b32237763d2cc4122f82e87c1ed759225e15ad5e1dd5c1effdb32740b4a3b4b279245d1dcd855d4b778562582a947a0d0d", 0xcc}, {&(0x7f0000001480)="f7d0b568a37fcc0e10083fb1c6ed8507a8e4d020ca83e91a91031e6fa617aca63286411329208cc929f62f32e2efb44758762bfc86f054d6cd003fd926e4b9faa11dd880623f7b", 0x47}, {&(0x7f0000001500)="a0ff05c71d5f84b6538e708e6762e0b977555096045303b80c509817aaeb8ab47d5eca4803ee6304457e3af48614a58a78a0bee4b0abc57e0d53a922935b07b8874cb995137cf6ee5ae440e4fd507ae7ec86d530991f7ec3af0709", 0x5b}, {&(0x7f0000001580)="a45d8d69cbb428b37b2cb5977ccba7a622b4d2375b98bfaa3fec0f8d566e2174d375a00499e63e2bcaf683ed8e846144781d1afb0e1a350a07be6edea346d6f5b4c3465960ecc560a4b70d2cc9e60876fb5c382504d4df36e9221022c9ff41ebaee101e34ed4b609816d707b7b1722a56a6b7b36efd474a6d12acefa8c7f8e1fbe6266a8c5191a8c5c0a48c4654ced03541f14111d16e49145338f5424d1dcf9693b5ee334eb4baf1acb852f98377db87a54a7eb2c1343e0865e45f3577b8fb9f1b75dc646fa5a79d43c2a2af5fd87e33f17716c3929680c3dc86b720246b201382fadc461c8c2", 0xe7}], 0x9, 0x6) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) [ 359.864799][T31729] loop2: detected capacity change from 0 to 264192 [ 359.924212][T31729] loop2: p1 p2 p3 p4 [ 359.928531][T31729] loop2: p1 size 78398975 extends beyond EOD, truncated [ 359.975364][T31729] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 360.001280][T31729] loop2: p3 start 2127165541 is beyond EOD, truncated [ 360.008165][T31729] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:23 executing program 2: syz_read_part_table(0xd401000000000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0480ffffffa5800800000000000000024000ffffffecd3cac765f8c97e8877007200300700a5ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 360.244185][T31677] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 360.252846][T31677] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 11:03:23 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) [ 360.370686][T31677] ref_ctr going negative. vaddr: 0x20000004, curr val: -31789, delta: -1 [ 360.379527][T31677] ref_ctr decrement failed for inode: 0x361c offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000032667f20 [ 360.398131][T31756] loop2: detected capacity change from 0 to 264192 [ 360.465306][T31756] loop2: p1 p2 p3 p4 [ 360.469830][T31756] loop2: p1 size 78398975 extends beyond EOD, truncated [ 360.504476][T31756] loop2: p2 size 1073872896 extends beyond EOD, truncated [ 360.535368][T31756] loop2: p3 start 2127165541 is beyond EOD, truncated [ 360.542185][T31756] loop2: p4 size 3657465856 extends beyond EOD, truncated 11:03:23 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0xf4, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r1, &(0x7f00000017c0), 0x3da, 0x0, 0x0) 11:03:23 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$TIOCMBIS(r0, 0x5416, &(0x7f0000000080)=0x6) sendmsg(0xffffffffffffffff, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x1) request_key(&(0x7f0000000000)='user\x00', &(0x7f00000000c0), &(0x7f0000000040)='\x7f\x00\x9d\x98\x06\x00\x8a\xe3\x7fs\x00\x00\xa0\xf4\xdb\xae\x00\x00\xed\x00\x00\x00\x00\x00', 0x0) 11:03:23 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x111080, 0x1c0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0xe0ffffff, 0x0, 0x0, 0xd8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps_rollup\x00') ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0x0, 0xf9, 0x5, 0x20, 0x0, 0x7fee, 0x20208, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f00000002c0), 0x2}, 0x800, 0x2a89, 0x3, 0x4, 0xf93, 0x7, 0x3, 0x0, 0x26f5, 0x0, 0x7ff}, 0x0, 0x3, 0xffffffffffffffff, 0x8) preadv(r2, &(0x7f00