y.selinux\x00', 0x0, 0x0) 03:11:07 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000000003ffff002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1717.056677][T20039] loop5: detected capacity change from 0 to 16 [ 1717.079781][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1717.088106][T20044] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1717.137380][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.145465][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1717.161337][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.169369][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1717.225695][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.233744][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1717.245349][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.253323][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1717.273282][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.281296][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1717.292550][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.300545][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1717.335621][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.343747][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1717.358032][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.366055][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1717.378974][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.386996][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1717.399661][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.407741][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1717.419792][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.428120][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ea8917f3 [ 1717.448264][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.456286][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1717.467828][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.475961][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1717.490328][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.498316][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1717.524269][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.532328][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1717.548853][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.556892][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1717.569167][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.577234][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1717.588428][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.596430][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1717.608057][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.616041][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1717.627318][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.635297][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1717.653785][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.661831][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1717.673301][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.681334][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1717.692719][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.700721][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1717.711983][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.720040][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1717.738350][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.746354][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1717.758133][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.766245][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1717.777514][T20044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:08 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e02}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:08 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) close(r1) ioctl$CHAR_RAW_DISCARD(r1, 0x1277, &(0x7f0000000040)=0x3) [ 1717.785516][T20044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1717.818880][T20077] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1717.827158][T20077] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:08 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x15000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:08 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600004c010000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:08 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) dup(r0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='trusted.overlay.origin\x00', 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) 03:11:08 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000000001fffff002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:08 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000007fffffff002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1717.842468][T20077] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.850484][T20077] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:08 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@random={'system.', '+\x00'}, 0x0, 0x0) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x101, 0x3]) 03:11:08 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000060010000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:08 executing program 1: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x585881, 0x0) [ 1717.903017][T20085] loop5: detected capacity change from 0 to 16 [ 1717.940891][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 03:11:08 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x16000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:08 executing program 2: fdatasync(0xffffffffffffffff) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) [ 1717.949301][T20092] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1717.965967][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1717.976961][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1718.009342][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.017668][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1718.067667][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.075740][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1718.086962][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.095038][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1718.115042][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.123040][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1718.134416][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.142558][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1718.179698][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.187720][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1718.202160][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.210177][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1718.222710][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.230710][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1718.242382][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.250457][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1718.262051][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.270108][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000057f989fc [ 1718.351938][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.360350][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000037e9aa08 [ 1718.380829][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.388863][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1718.400303][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.408313][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1718.419490][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.427490][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1718.453981][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.462111][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1718.482284][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.490338][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1718.501536][T20117] loop5: detected capacity change from 0 to 16 [ 1718.507389][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.518994][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1718.534156][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.542251][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1718.555166][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.563176][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1718.574803][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.575601][T16800] handle_bad_sector: 13 callbacks suppressed [ 1718.575612][T16800] attempt to access beyond end of device [ 1718.575612][T16800] loop5: rw=1, want=256, limit=16 [ 1718.582925][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1718.592205][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.618876][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1718.630685][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.638823][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1718.650541][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.658561][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1718.669862][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.678121][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:09 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e04}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:09 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000000ffffffff002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:09 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000068010000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:09 executing program 1: r0 = syz_io_uring_setup(0x2de1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000200)) r2 = openat(0xffffffffffffff9c, &(0x7f0000002040)='./file0/file0\x00', 0x0, 0x0) io_uring_enter(r0, 0x302, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r5 = socket$nl_audit(0x10, 0x3, 0x9) r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0/file0\x00', 0x40cc03, 0x3) preadv(r6, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r7 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001780), 0x3, 0x0) r8 = syz_open_dev$ptys(0xc, 0x3, 0x1) r9 = syz_open_dev$tty20(0xc, 0x4, 0x1) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001900)=[{&(0x7f0000000000)=@file={0x0, './file0/file0\x00'}, 0x6e, &(0x7f0000000180)=[{&(0x7f0000000480)="935c98c60b8302295763ab10fb28e264e3ed87532998b15a417d4a99e357e32bfa41798a84c84a5e275206529c5d46c4231f5ec3a019d2fc992a4bf5a24bd22992ef8054542f2405e32135039397e0335e641cbabfc070177f8239f268898f95a6c7550ae5ca80dae3ca457f72bde4d77589805185110d2dfec5ea465dbe121eea9548506ec20c7b4995c1ae0f15b2d16493a52911174cf4d76578771d9d11610f21a754abe44c515972e6e893ae0067cb1d99dd786dce2c64ad7c5291980adab6eaa2db0e61656680030db0a280b08f66711f2b80ad64acc10afcdd0e08b93b051ca0187426edba14c660662acc8eeec855f998f18713d600904bc5bfa39ed72b23ba2fbd81ab56e6f9c2a014cf6d3fdd378e00a0d474a2789a3fa4096d5ff0055e665865da6b68d9ca45fd51081b3c5ee0fc1620eec172fdc6b2518c732d66aa875b014a3b4173fa85559efe51c173a6fbe1aa6896eb965c47f14b90779ce53cc280201853d1247514875985ef4027a61cd333637cd4ab5f3497da300896450dd248ec4c5162b5c531b7dcac434aed1b427440843cf7fcb5269b68bbc8b759da6d6f46564d1412ff44db5952849a44c6644cebbf044d19147694dbfedbf5cd85b12e9fd98523372163e4c3f4e54858b814a2e106db51a91632bce38b08e46c397e2734a2d30fbf9b08a3d7086ebba0c8c9bc220262784e77cf77a18efd04d62ccd37e4d79b89aa5c49fca69f13e29923db5ecfe2628e87db88c361fefa67c3a3c810fad443a8479ce0e74e6f2235d7c6ef9b2d1b1737c74c4585b6657e2e0449bf62ca6aedb65827f0bd9daab4b3d6a603c63dd9d098d9bf07f75e9965cb55d03ec1ec2d6bbf42fa0857ec7373dc7fd3c316aab9c9ad13a2c0ad6bb0691b3b6920a658fcaedbfcfd6687343776ccba656b96e9051e4dfcdf102659277e6ddcdd9b97c96fa842da1eeb292e009cfb15bdf7272e07c7649395393644e3e21a400c1b6f32b63fde31e45af60799e2b36a570503b4b0e6b222fd0caa4182060332ed016511a413579b3ed7e0ccf83eda48ffdfa7384ceec8e7251380c17519d0cbc2701d67064eb4d1c15db80b4f8e64cff4c5abaf51a5c8ed57d89b8d3ea9ed9884c5b66d3047c90e8ae93865e1ae8acd34c3f391a739f0695299bdf556295e3bf366080f5408d24c8dadacaf83f46df75a425854527dc4b7e872b67d41488cdef9603283bf85277fd381a80b2d06a4a98c5e3e61c1a10d38dc3aac605ad363e2de391c7b84253287dde7beff74cca6791c6536c646bd20d8c2afb713a765dd7741c06ce1254792478234af25abe9f213d7be45ff605a3f9f210f36baa69d8137d83d184081d9ecdaa81c92bc332309c15cdf4fd3af8bea3e667c34260f2f28c03da0f24f05139c7853b4e85685ccf41f756241e94d9b100dc2da409c94b097b4b66e26fd866000c82b006dd245105d962f0f5bdd6b5468c8485639b6e7445cea812265843575dde9513c9c90728601a6ad26a6bd4982f1df4047ccc46ec61bc34b5cf79565b6f88c72f671c56412c92604af880b72cc57491b054e3bad87ca99c591262ff0db282000e419559023e2afb9582f14e64d0c030797e2a60695c947719d5913a569e9aa18c4881c838faa29d17a673893bcec7fcc629d237da2d0ef397f30a0b4fd1548c97f4d62c85a3b837a08fe46b1bd21514f7993498a763fc35299ab726b1f9c3aa779fbaa2d821c54fbeee8d1092fec8e9a558843264e5f73e103374b818a87e8a4edb06b9ddce98d2cd489f86e520f7c897a0e10d5f2a8d1ba0c2bb09290752ef8ec0940388fc554acdd9d2dc4eaf49501624451b4605169b29f41111c4a854d233e5dd2999aafb3f085d6156be898daf5fb7e1e9676b9efa712374bd0a11e30b72113c502490f1ba2f29543842d9d1ea0f2b7e6df35dd8b9622178f5a269d19a7d3109ec91256bf5f704178d5b8c880f99c7157ff7ebc66756fc6605caf5b96ec40fdc4559062fe0a652f004c96d23b43d6bade45e1cb9d8fda8abb416608792c79122018eb9a2b3191d3821e79b5febb7ffd8fab553935e4ad8bbdcbd93df4d3f785c14f2f20cc2191fb6d147957797454d9567d9164fb8e176a6cf63bb6ca755855fc0fccc87bd917ca7e08a16349985c0058d07a532b4e99b5af3f019992b1399fbafac8068090000c8b0bd22f973e2ea6afdebac79d92c41d1e07b1c49cb2931e7775be21ad490172f09d0788ecca57646d02c15bed54e3d4db290760ec8fde5203ea8b952f52e9fc85e6e1aee00af8bda77599fec589c9f01ba384f5c91e0dc5fdf73ccc0d9bf2ff82e4c2efe56fe08af8e226fdd8e1c4f476edb2a21abc962ce4dd0124698d1b2d10e34d8f9cdeb9046b8a7154ae5b02fb95b745224531b49c1ff10f08cf4d18e5fc8798af237e7bb4c0a7e3855fbc58c1c35e4799b5e3d4d48db38e05f28e13c1710bd7dc448cb69d8b561977916a7ba4a1d6fd24703dfc705ce527ba3675f550fe28e3ba832d127cd39fe0bc01fa09b87e7c1ee92cc9e5bfc9b30cfdce334ddf676d6052e80b44822a303a8b59193c7377aba70cd7103ad9d432fb0fc28c7a96274ef33f5ff13ad745c6d43202b0804df47b24ef2dd97ac30149ec4f88c1dddb432e3983ea669def28f5935c503b7e9a8e165c10a6cd1339f6373beeaaa326f6b505971af72b635e7a5d48a67eacdc041ccd6a101224ccb3249392daee5db8da605e858c98163ab4c35b97f0cc7cc466feb1017e47bdf17e06b59a8cf6a1f0457fc35563c337e89b7b55ce9b9ef264a83f2325b157f78f197ed3fea2e4cffed0967c26c79352542bd30c70f57a6254741e21676ec885897af31cb91881f79a7cf137a9386746f8dbb63eb1c54911ffb09164305ce7fd403395be390bee93ce8cd7f7311ca4abc6756a1fed41e17bbf0baa40aa5526df9106d1595106adea14a987f10321802bea90576597f69ddaf6e78d6305beb4b84636e7118f500b1a7bff5695de6e878adad3947c9d179e21768c1a44c7cb34230558e9f1fc13ed51480aa56045f44ed573c317b1ffd8806fc145fd66ca33cd8a49dad4397ff6ef801fcda1235656da6a8839b6e5ee7f2ed132940368bf711c76683d9f4ff1c642b6784a4ddf60e1883f7a99f4a0b35f15c0910be804b91e81d1fde592b821dc3691f1e78d02120b20378287fca5d0d684a9c474bd481e4183297f3909d431d982968f65576cb0034c828af5056470677383f32f33365aee6a1ce218ccc546811362f7fc382a1454db62b100da784398c8465491ea1e91e6ff79805428f924dfcff53d3116821cefe1dc7d1d5cebd0e371288fb57f8515745f7c9c47767e20ce6c922af40f701d88ebc7341ad6c7ce914b15d3f97b747f0a386d49a387a17a6b4beb01defa7a97b0d779a52f89237d552c29c4bfb54d6c1d0589af48f512c1c165fb05e893f1a5292507628fa1a86b82a770cd1348c613832f552e8a83a23576400cac75c23ceba9d7ba66913332ac4101c0500760aaef07af9c7971d12f8e5d033cb64711801fb049e4307843da5ea08813950eb5f712252fedeba61b8e7fbf343c8424d343d5b657bede4394a0c5fd5647fd8d1758eaf7c03d0191aa9ff0670964c972f289991d2652b85e6d9b60e573780a37205ddb6b4c6b7b2fd4d91a2868c616ea0d11e5253954a4536098ee9f4224695b527df0e5746a577039160352da0ba581ed28be7dba5758528527446adf6c43bc5940cd05852bfac9d80fd3bc2419a2aaf1ac9124b6fee3b3c274e25ce70af6ac1ea4d0bd90687f7789da2a2a4041d24cb1b96eed48ef1a06ae8d095e9c5be2924b98af5ae16c3e49a131f8779d227023a926349b0e0928c20621b9d398b799c7ba8a0820ccdd1250823045999349caf667a69f3edd235f9022d0080fccc482b4addbb3ec3b93bf04b2c3d04e21a8e037320b4eed90b827a18c090dae9066d1878c92b4f12dbffc7d92856607b4cf914b6d773a72373bd7f5315dff06279a6fb177aba81bee23384a168f779776655f98393369fca3cef377d4a5b09ed22d3bd4332c52694eb88ead2891727035d289c0c803813c67ff605dd5a97d77d6cd3ad8b74717289a9d702418cba857ccd6687be66d95a967372cd5421ca89c0278ab8cc88393919d36530bade754b251243c0d2e3b93b19a0d85dc6259bd9b53cff652d2c62dcd6ae5369085ce5b75f1c750f20369219b21168614116fc2438c701beb9829316d0957adb063808d05be9a959342513adf9a720d9b74ff8572c258098044d4c3a4c78c6b54a3e3916e0ad2ac16a65305d9f49d2261ac1d4577bfefbb28fd468f7d42be43aa43c1804ebb3cdb93c4783c8cab935130b03ec768c805d6f2f55c7fe90eb0aca825c0bb0243dee18132975bf1001e9c7c25742f00aa0b73158f4c5899ea8f750e065464e4db56520e1709e2a9272dfb224ded8fc9b83260a019b2fb417a68900afdc51087db9f402d6251653d7b52fbddbf78b01ccfd70e88d9c2d9e114e36700ae5c4511631963b99eaea8cce5428ab3a49b8696d6bb7f8e8a1f20081cf27ebef266ac97a7f850e37a9044e825c237bcb8c9383ae13583aa33d06ea7c71be05f24e52be65d2f1a0d98294ee76bec0b6f2546dc7410b546b337120fca471aea96759e2ac5b395a5bb39b2c20c94e1931ae1ac422ecaed64f8af56ade74533e6c493a595e2992f13644f32e19d876b814acbfd9419055404951dcc99096abde3d360f6d75bb293fb3e98959b5c0c6e41cf782ecf88c7c5938f5ce6839685c0224e40f6c351a88a42a520dd39e852113001181403f44aacdedea1ccfa0f6924aa8da8b4f54398497dcd175325327d525ec268fdcb37214a51b8d80a6d5361b49c116c371026812f6f47bb42bf7cb0075b3ca65efb173e9eee97e5f117f78574efb245170bbb695f7b47910c5c88077d4f536770dd8265e1d1082b92b9de8595e64f87612105114ab06918c879d6dff3f1227bcd812e5f08bce3912bbbec1dbff8b85679f82e984cc275eecbc4aad8cdf74df0323a7e95aae7778267802cf1cb7218e83d2134f51ae06761d1f1cefecc48f83355e92253b51bab8e809febf4341be5cb590353b39ae846e758ac347c775857d3e5689ab3bc1340135c3962e978c2e4b20a9cda5a73dc39e262bf7834a822cf6c856e834064b33fecb05b7ba795bb74c29862be312640a257de59a6a2bb545acb701dbe496f3c732a973c34e32afa848224000e1603cc834f34fc6e72fd31c2869c37ba32f544ff9414dca90b251661900a42d76e90ad06a0c89b3f2481973da0d4e0c3eec9ff94fa8d4ed6f098874c1978f8b822a50f335a90cf34308173a6c8387ef1dc1fd3892bf1aa8eba46f49f7fc1dee548c3c25a9139f8a12ea7739c53dd10cfe918db4d940fd3e09c578beab39ccae177e68e6207c64fa6ee29872be22178036978c51338d079b8eadf2b6cdd5e3c46516dc3b3d5dc680bd700a4402ba8cd1309f94e2058f623f34f660ecef6feab1c2f58774df3d569cd447d92a491f43867c7bf6b8b8f8f4a05ab1a6cb575016808b353c80372cd4de3e728e0877257b1681335bc5e6ff1e7c364868fb451a3cbcf5144add408c5f449a224f973b352acc7d4a9932969d2cb812e954c71b84aeddf45749b65dccdfd2eba3c262e7594ff8d844c6f4fd39bd70563cf0e3ff19618780d6b9717e81fbfcb294f5af049e4b01903735de83ec7e430e8cd93e0ddd85eff214c678fccea6d5a9615829bfe7bd81d83", 0x1000}], 0x1, &(0x7f0000000300)=ANY=[@ANYBLOB="1c000000000000000e00000001000000", @ANYRES32=r1, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x20, 0x40}, {&(0x7f0000000340)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000001540)=[{&(0x7f00000003c0)="56eab1b37a1015a8259489db287a7ed09997269f9f4685911f3a48ca0c8ce669e1e133e279b0490dabb65ea3e3c0ccf61083a0c629187c2c0aad6324b30c5e09bb9496d16085031f6a3c6ac6d2396f97861f9c7daf3adcab8f6a6c9e21d3f72c3655131629899803f8f295f140aa3675d97a", 0x72}, {&(0x7f0000001480)="0abe5868342699597d1817f01944bdcb19700c61dcec62e5e56fe3d39d7bd1db3d44cafb55a669f8d5574ea436dd436699588542ba5c35f39032fa22a5fa489c6b45e38b7d171a479accf4f706fc31d14face3f4b3c243ae9e186bfb263fc6ad2f2a492cc7f68619658406077f924a315db8b8c93fe038135ae1ebb5aaffd4ccccb65e0585be0dcc69e8049777649c68dc18b7be8d118d8749c675056fe990b12fb6d99da06bb9b1b70cf9010cc4bd6edb51f807", 0xb4}], 0x2, &(0x7f00000017c0)=[@rights={{0x24, 0x1, 0x1, [r0, 0xffffffffffffffff, 0xffffffffffffffff, r1, r1]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xee00}}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xee01}}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, r2, r2, r3, r2]}}, @rights={{0x38, 0x1, 0x1, [r4, r5, r6, r7, r0, r8, r2, r1, r9, r2]}}], 0x138, 0xc000}], 0x2, 0x4841) ppoll(&(0x7f00000002c0)=[{r1}], 0x1, &(0x7f00000000c0)={0x0, 0x3938700}, 0x0, 0x0) r10 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r10, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) 03:11:09 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='system.advise\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x101) dup2(r0, r1) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r1, 0x8010671f, &(0x7f0000000040)={&(0x7f00000000c0)=""/212, 0xd4}) 03:11:09 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x17000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1718.791647][T20092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.799936][T20092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e 03:11:09 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000002000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:09 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='freezer.state\x00', 0x0, 0x0) ioctl$TIOCNOTTY(r0, 0x5422) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$FITRIM(0xffffffffffffffff, 0xc0185879, &(0x7f0000000100)={0x2bb, 0xd44d, 0x2}) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x82000, 0x0) ioctl$EVIOCREVOKE(r2, 0x40044591, &(0x7f00000000c0)=0xa000) fgetxattr(r1, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:09 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600006c010000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:09 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x18000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:09 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000003000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1718.897751][T20143] loop5: detected capacity change from 0 to 16 [ 1718.914983][T20143] attempt to access beyond end of device [ 1718.914983][T20143] loop5: rw=34817, want=184, limit=16 [ 1718.921295][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1718.934308][T20139] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:09 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000074010000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1718.956304][T20150] attempt to access beyond end of device [ 1718.956304][T20150] loop5: rw=34817, want=184, limit=16 [ 1718.958972][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.958988][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1718.960646][T19085] attempt to access beyond end of device [ 1718.960646][T19085] loop5: rw=1, want=256, limit=16 [ 1718.963555][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1718.963566][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1719.008797][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.008811][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1719.008932][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.008944][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1719.019018][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.108656][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1719.120326][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.120341][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1719.168095][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.176134][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1719.189926][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.197950][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1719.210741][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.218757][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1719.229967][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.237947][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1719.249545][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.257687][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000651335fb [ 1719.371312][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.379451][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000037e9aa08 [ 1719.399462][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.407643][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1719.418947][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.426949][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1719.438221][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.446198][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1719.471909][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.479950][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1719.494688][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.500700][T20173] loop5: detected capacity change from 0 to 16 [ 1719.502709][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1719.522282][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.523724][T20173] attempt to access beyond end of device [ 1719.523724][T20173] loop5: rw=34817, want=184, limit=16 [ 1719.530462][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1719.552468][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.554815][T20179] attempt to access beyond end of device [ 1719.554815][T20179] loop5: rw=34817, want=184, limit=16 [ 1719.560482][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1719.583099][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.591150][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1719.602445][T19085] attempt to access beyond end of device [ 1719.602445][T19085] loop5: rw=1, want=256, limit=16 [ 1719.610716][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.621106][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1719.633018][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.641181][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1719.652808][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.660809][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1719.673081][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.681298][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1719.692818][T20139] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1719.700842][T20139] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:10 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9700}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:10 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x2081, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = syz_open_dev$char_raw(&(0x7f0000000040), 0x1, 0x210080) dup2(r0, r1) r2 = openat$cgroup_procs(r0, &(0x7f00000000c0)='cgroup.threads\x00', 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r3, 0x8935, &(0x7f0000000000)) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3c) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r4, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x1, 0x1, 0x6, 0x1f, 0x0, 0x2, 0x8288, 0xc, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf696, 0x2, @perf_bp={&(0x7f0000000100), 0x1}, 0x1000, 0x9c1, 0x0, 0x2, 0x3, 0x5, 0x100, 0x0, 0x3, 0x0, 0x54d3}, r4, 0xf, r0, 0x2) close_range(r2, r3, 0x2) ptrace$getregs(0xffffffffffffffff, r4, 0x104, &(0x7f00000001c0)=""/96) 03:11:10 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f00000000c0)) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) 03:11:10 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000004000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:10 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x19000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:10 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600007a010000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:10 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000005000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:10 executing program 1: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) 03:11:10 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000fc010000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:10 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x1a000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1719.841370][T20191] loop5: detected capacity change from 0 to 16 [ 1719.876123][T20191] attempt to access beyond end of device [ 1719.876123][T20191] loop5: rw=34817, want=184, limit=16 03:11:10 executing program 2: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x181000, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x4, 0x20, 0x9, 0x5}]}) r2 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x204}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001a40)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r2, 0x50009418, &(0x7f0000000400)={{}, r3, 0x14, @inherit={0x88, &(0x7f0000001580)=ANY=[@ANYRES16=r4]}, @devid}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000080)={"f4442f24beb85d6dbeb7176202b31b96", 0x0, r3, {0x100000000, 0x6}, {0x80, 0x1f8c}, 0x9, [0x2, 0x1, 0x4, 0xffffffffffffffc5, 0x4, 0x5, 0x1, 0x295, 0x4, 0x8, 0x7, 0x800, 0x7, 0x0, 0x9, 0x9]}) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r5, &(0x7f0000000000)=@known='trusted.overlay.origin\x00', 0x0, 0x0) [ 1719.910781][T20208] attempt to access beyond end of device [ 1719.910781][T20208] loop5: rw=34817, want=184, limit=16 [ 1719.924260][T19085] attempt to access beyond end of device [ 1719.924260][T19085] loop5: rw=1, want=256, limit=16 03:11:10 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000006000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1720.021204][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1720.029533][T20200] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1720.081976][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.090063][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1720.108575][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.116734][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1720.125711][T20223] loop5: detected capacity change from 0 to 16 [ 1720.173001][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.181182][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1720.192803][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.201096][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1720.221805][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.229984][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1720.241199][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.249214][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1720.284954][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.293020][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1720.307269][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.315401][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1720.327968][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.336252][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1720.348135][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.356143][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1720.367560][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.375567][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000651335fb [ 1720.471568][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.479785][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000c6b8909d [ 1720.500237][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.508286][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1720.520363][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.528382][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1720.539710][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.547786][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1720.570178][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.578218][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1720.590704][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.599662][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1720.612125][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.620136][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1720.631388][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.639465][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1720.651096][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.659203][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1720.670599][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.678674][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1720.690465][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.698474][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1720.709706][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:11 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb401}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:11 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x500, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, &(0x7f0000000000)) 03:11:11 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000fd010000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:11 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x1b000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:11 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000007000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:11 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x485a41, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setfsuid(r2) fchown(r0, r2, 0xee01) 03:11:11 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000008000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1720.717694][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1720.728948][T20200] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1720.737156][T20200] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe 03:11:11 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x250040, 0x0) fgetxattr(r0, &(0x7f0000000000)=@random={'security.', '/dev/vcsa\x00'}, 0x0, 0x0) 03:11:11 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000009000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:11 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x823006, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@cache_fscache}, {@access_client}, {@access_any}], [{@audit}, {@fsuuid={'fsuuid', 0x3d, {[0x62, 0x31, 0x62, 0x57, 0x2, 0x34, 0x31, 0x31], 0x2d, [0x0, 0x66, 0x0, 0x31], 0x2d, [0x0, 0x36, 0x34, 0x33], 0x2d, [0x34, 0x62, 0x39, 0x33], 0x2d, [0x61, 0x37, 0x63, 0x33, 0x64, 0x39, 0x62, 0x61]}}}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/vcsa\x00'}}]}}) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) 03:11:11 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x1c000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1720.809172][T20247] validate_nla: 38 callbacks suppressed [ 1720.809186][T20247] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1720.825374][T20250] loop5: detected capacity change from 0 to 16 03:11:11 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000030000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1720.868909][T20259] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1720.879899][T20247] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1720.890717][T20259] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1720.988675][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1720.997110][T20249] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1721.049938][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.054227][T20272] loop5: detected capacity change from 0 to 16 [ 1721.058006][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1721.085011][T20280] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1721.094579][T20280] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1721.097338][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.110781][T20280] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1721.110986][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1721.121341][T20283] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1721.167602][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.175775][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1721.187132][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.195600][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1721.216785][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.224963][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1721.236154][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.244161][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1721.268924][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.276960][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000057f989fc [ 1721.299147][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.307603][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1721.321737][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.329744][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1721.342498][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.350564][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1721.361816][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.369840][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1721.381357][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.389350][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000079427f69 [ 1721.490834][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.499309][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000000ff2283b [ 1721.519251][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.527272][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1721.538987][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.547105][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1721.558642][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.566644][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1721.587382][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.595431][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1721.606736][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.614738][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1721.626908][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.634902][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1721.646168][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.654245][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1721.665798][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.673803][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b 03:11:12 executing program 2: fgetxattr(0xffffffffffffffff, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) 03:11:12 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000a000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:12 executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r0, 0x8010671f, &(0x7f0000000100)={&(0x7f0000000080)=""/71, 0x47}) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = openat$cgroup_devices(r1, &(0x7f0000000140)='devices.deny\x00', 0x2, 0x0) preadv(r3, &(0x7f0000000280), 0x0, 0xd9f, 0x0) fgetxattr(r2, &(0x7f0000000040)=@known='security.apparmor\x00', 0x0, 0x0) 03:11:12 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x1d000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:12 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000050000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:12 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb801}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:12 executing program 2: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(0xffffffffffffffff, &(0x7f0000000000)=@known='security.selinux\x00', 0x0, 0x0) [ 1721.685411][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.693734][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1721.705633][T20249] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.713716][T20249] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 03:11:12 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000b000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:12 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = openat2(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x80001, 0x44, 0x10}, 0x18) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000140)="858bdc0d3f2dd9008d92f6502ce33a2ae8b880cfe79a6401067d86d154241a2a0a69e96e967969d35b6f5be1e73ab094cac1d458c8924f8065d385c0c9a4f595c459c519a4608f97308652229a9f87ef9cdbf38122497e48c602edbe3d080327329873bf7d57a9ac92147abddcfa49a28793626cf52e7db311e0501f0f10855f0930c70f6cf5848ea150d3306badfc018cfe123aaf597491f662426f246260b225ba175aa0c283bfe0282b35d50efb829c4490248972d74bfa7a295d9b7d64ec36ee39e986407c05c2001e08", 0xcc}, {&(0x7f0000000240)="5925371a2d5e8f198676db64a670124f401997604bb24cfe1ff395aa17f3cf3ccb4825e781352e9430cf3b1fe203732162895715decb38659e7ccce39a55c60420b61f531efcace5a74ff32d7d959e1cbbae3a74ac49a501e4c23bc6cedf03b99a44cf202dbe817817d6f5cdd1b62ffa847be080ae9331c90603a963", 0x7c}, {&(0x7f00000002c0)}, {&(0x7f0000000300)}, {&(0x7f0000000340)="ac1fd01fc48884316d81c2fb30c0d871e2dc8189aaa58a4f1f8160408f77baecdaec8e71595930da9f5b69ab2bb475c831b3ecba76a1a471a7a91354f6b01c80de006ce292f351a0af92100aa6b13df2dd116dbdd32a39a6ee6a24fa6e0b75ca7e885e79aafd42fb6bfb2e48b585994c8781fbd024593ec94f55cba77d899af4f2971bfc9aade2adb18578eafeb64b98f0484d44a7b7d50f7fed7e453b61851ee42a9b4d0533259f69109192d3d1edb47a42fad638a0c498d3f9da32a3813c81eb46f8fbd189d853479608a325cf6e6894de2f10202a1d369303bb1d8cc2", 0xde}, {&(0x7f0000000480)="3c6304a9fa1d0ab4014c71fef6a02a0a9a849c823c4e50c1c2b114e07bdc3ab8cb22641ac9ee8a63dfee3a88b1aa880b851f5db1bad8b115a7acaab3b18fc00c46de87063077de7439ac6ba978e6516643c0eae0b43a181450ef336dff0c3e5a8133528dfb616e169d3fd7aebbc9c1e06d979c69e415", 0x76}, {&(0x7f0000000500)="82ade599325f3b5b5934bfc1e976aef2915792e1caf2222734f18d24bb1ff6b49db5dc17f18e7a05350db174794ed9d4b4d4d7449807", 0x36}, {&(0x7f0000000540)="bd4d6ede4e5aad8605e810f0faf264da44a6e926fa71dfa0a3ff52bc25e068ea7b753068fa", 0x25}], 0x8) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) ioctl$PTP_PIN_SETFUNC(r0, 0x40603d07, &(0x7f0000000000)={'\x00', 0x7, 0x1, 0x8000}) 03:11:12 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000060000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1721.770499][T20295] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1721.776749][T20298] loop5: detected capacity change from 0 to 16 [ 1721.794924][T20295] netlink: 'syz-executor.0': attribute type 4 has an invalid length. 03:11:12 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000070000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:12 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000c000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:12 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = accept4(r0, &(0x7f0000000000)=@x25, &(0x7f00000000c0)=0x80, 0x80000) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x1fcc}, 0x4) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000140)={0x4}, 0x4) [ 1721.826305][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1721.834641][T20296] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:12 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x1e000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1721.877605][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.885700][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1721.918701][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.926907][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1721.977676][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1721.985821][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1721.997500][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.006002][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1722.027993][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.036353][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1722.048209][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.056245][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1722.096610][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.104906][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1722.119712][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.128103][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1722.142337][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.150638][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1722.162218][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.170247][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1722.182839][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.191045][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ea8917f3 [ 1722.225796][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.233906][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1722.245482][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.253512][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1722.265983][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:13 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000a0000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1722.274015][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:13 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000d000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1722.318612][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.326894][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1722.372846][T20335] loop5: detected capacity change from 0 to 16 [ 1722.405994][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.414037][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1722.445438][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.453514][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1722.479847][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.488097][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1722.499629][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.507653][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1722.518822][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.526847][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1722.538790][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.546878][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1722.558084][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.566085][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1722.577313][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.585296][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1722.596471][T20296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.604508][T20296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:13 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x1f000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:13 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000480)="66530700ae897094e71b0fa1f147a8378f364602812c66538d750f6ee1d001f43f0500bb9fb045f2d1eaa302ab6c2fef2308003ea1315b9532f3af2f5e153eb78020fa00eb298802d8f6c1f3b18d6d352507f7018b31a53bad1ec3533c791a753a1fef2c560001000000000000fb8005128e7e4d939955f8ac396203784000400f573fbf000000000000000761f35e959f130dec95128ce7ec033dc0a380543bfc99320be1c1bb99bb063fb66f2d696569eada31b09fd215f0332701d9d14a3f9209d666578cc0266bce7860eaaf305a0ee2af0f82dfefd5e00d421b000000000000000000000000000000730428fde6136b8e97c32a552843516ab78c83f85cfe873f70957000dac653b3b313d89a46e152f505778305470dad528d3b41f1f70f3e58625c153cc74112", 0x12a}], 0x4, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x5) tkill(r1, 0x1e) ptrace$cont(0x18, r1, 0x0, 0x0) r2 = syz_open_procfs(r1, &(0x7f0000000100)='net/sockstat6\x00') sendmsg$NL80211_CMD_VENDOR(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="52ef4fb1eb2103335d9607e393cefa0a84b592295f1338cf78a24ea1892956e105999bc66e07f018a56456", @ANYRES16=0x0, @ANYRESDEC, @ANYRES64, @ANYBLOB="0820c30000ddffff0700c40000000000"], 0x34}}, 0x11) ptrace$cont(0x7, 0x0, 0x0, 0x0) waitid(0x2, 0x0, &(0x7f00000001c0), 0x60000003, &(0x7f0000000240)) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) exit_group(0x0) ptrace$setregs(0xd, 0xffffffffffffffff, 0xb45, &(0x7f00000005c0)="c87eee64dae5aaa8b8dac4ea641ea413959e93eff2ba6dc8bfe4802d99ff7d65c8d2dc34cde95e6f5c0559049ade543f18250231e18126738be840edae4db3b723f08d85874d4398238e48381a3617f22922213f1589fcbbe36529ac6718f7f8bf754d3d09b9a1474962a8e1bde704330121d27649755bbb6d08c0e0c9ce930fcdf37a9d65126514290686dc2457a066e4047b10206a856e60063e561b18334e5cc9402f2701f12c27f1b5ff") r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r4 = syz_open_pts(r3, 0x4200) close(r4) fgetxattr(r3, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:13 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf02}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:13 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r1 = perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x11) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x200002, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000280)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r2, 0xd000943d, &(0x7f0000042dc0)={0x7, [{}, {}, {}, {}, {r4}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r4, r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r5}, {}, {0x0, r5}, {0x0, r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r5}, {0x0, r5}, {}, {0x0, r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r5}, {}, {}, {}, {}, {0x0, r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r4}, {}, {}, {}, {}, {}, {}, {}, {0x0, r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r5}, {}, {}, {}, {}, {}, {}, {0x0, r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r4}, {}, {}, {}, {}, {}, {0x0, r5}], 0x17, "effdfbfac8aecb"}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r0, 0xc0709411, &(0x7f00000000c0)={{r3, 0xffffffff, 0x4, 0x401, 0x40, 0x5, 0x7, 0xeab6, 0x9, 0x8, 0x3, 0x1d8e, 0x1f, 0x7fff, 0x3}, 0x38, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) 03:11:13 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000b0000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:13 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000e000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:13 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = openat(r1, &(0x7f0000000000)='./file0\x00', 0x440080, 0x1d1) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r2, 0xc0105303, &(0x7f0000000040)={0x66, 0x9, 0x6b}) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) dup(r0) 03:11:13 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r2, 0x8935, &(0x7f0000000000)) preadv(r2, &(0x7f00000001c0)=[{&(0x7f0000000140)=""/116, 0x74}], 0x1, 0x8, 0x8) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) sendfile(r1, r0, &(0x7f0000000000)=0x5, 0xe0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x2d) ioctl$sock_inet_SIOCSIFPFLAGS(r3, 0x8934, &(0x7f0000000100)={'wlan0\x00'}) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x50d00, 0x0) fcntl$getown(r4, 0x9) 03:11:13 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000c0000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:13 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x581, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000040)={0x8}) 03:11:13 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000f000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1722.790474][T20358] loop5: detected capacity change from 0 to 16 [ 1722.842357][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1722.850786][T20360] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:13 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000010000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:13 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r1, 0x8932, &(0x7f0000000240)="49804acf0f741fb6240f6f6884f638c368431b246a19deac39ebd882622ebd3d3d692492727f8db9fc2406696c399f294c1547f3094b3dfb9a7089df81ffaee83a5c8262705d2b0b8a139d6ac07e84f42528d5268aefc2bc9018e46d7714629a8cdb6c26045efb8c8ec118d0429741dc151f301e4f8bf6561c02b92f94ea5c530f77ee343dfad815835eb746721f69c63346984db5c495a7767ba6a7fdca3c2a4c4d664b35eccafe1fb03e76b682c0c6c087119252fae5a0941e43e058aac6d2d111b1a54c6e1e286f11f02e60022cd2bc40c28851464e7ac7d5e65da97186323c62fdf10a353aea049143b89d69091c8df15788724768a8cddeebdfa412a29be66769d9d3b80b9a8f6a9a101f9b2ccdfbe554e8c6d1278fcc6c4b9ba94989a36283691b7756fd4579ae8eb3297e16fd583917d3eed40750f117382feb8ade042c494a4b1f8a5bc216f600ebc5f1f83f515ba46fcb0779ef1c72fcd82c68023129ee51ee1e6a75c1fa0cabdabdd7a6c7712f6049baacf572e4e9047e2de8c4d06cb46b56a7f3e8c63317e20ae380237c8252f29bab22c077466dddbc7255103c") r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) r3 = getpgid(0x0) fcntl$setownex(r2, 0xf, &(0x7f0000000040)={0x1, r3}) dup2(0xffffffffffffffff, r1) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x800000, 0x10, r1, 0xaaa36000) 03:11:13 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x20000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1722.894868][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.903018][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1722.917476][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.925500][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1722.982722][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1722.990902][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1723.003113][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.011266][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1723.032292][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.040380][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1723.051773][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.060044][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1723.096297][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.104346][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1723.118992][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.126994][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1723.139340][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.147334][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1723.158514][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.166540][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1723.179248][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.187541][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000037e9aa08 [ 1723.206808][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.214919][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1723.226106][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.234212][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1723.245441][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.253448][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1723.280930][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.289030][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1723.301178][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.309202][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1723.309481][T20405] loop5: detected capacity change from 0 to 16 [ 1723.321805][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.334617][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1723.345763][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.345778][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1723.346189][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.346199][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1723.346258][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.346268][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1723.346927][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.346941][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1723.347107][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.347116][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1723.347207][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.347220][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1723.347266][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.347276][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1723.356802][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.490778][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1723.501956][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.510104][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1723.521314][T20360] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.529389][T20360] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:14 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe800}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:14 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000c00e0000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:14 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) fcntl$getown(r0, 0x9) r1 = socket(0x10, 0x803, 0x0) write(r1, &(0x7f0000000380)="260000002200470508d258002b1f00eb0101c7033500b000"/38, 0x26) r2 = eventfd2(0x80000001, 0x800) splice(r0, &(0x7f0000000140), r2, &(0x7f0000000180)=0x10000, 0x6, 0x4) setsockopt$sock_int(r1, 0x1, 0x20800000000008, &(0x7f0000000280), 0x4) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_KEY(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x20, r3, 0x401, 0x0, 0x0, {{}, {@void, @val={0xc}}}}, 0x20}}, 0x0) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="ed00a625bd7000ffdb5f255a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c00bbc1b1777c000200000032000000bfa04004fb0f91ae35640df0c0d5fb6c4ec29184d9da75dbe063ba510aed198adfe725c362196246415f008226081f66d4ab111614942985"], 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x800) 03:11:14 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000011000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:14 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000040)=@known='trusted.overlay.opaque\x00', 0x0, 0x0) 03:11:14 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x25000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1723.578168][T20419] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1723.586693][T20419] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1723.602119][T20419] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.610322][T20419] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:14 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000f0000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:14 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000012000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:14 executing program 2: r0 = syz_mount_image$msdos(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0xfffffffffffffff8, 0x6, &(0x7f0000002480)=[{&(0x7f0000000140)="59f26a3c59db98233a6f6e435674bc5d96db5d01854bbd465ffb5ffc2846e784bdd0a4f27803809a036de5d806b9b702b637a103ff7add83bfceace2d7c0d5475625ac415dc3579c81f217fcfe63a5e289b96ebe7bfb6eb8621351172d04d098855bd1e3adcb4915f1077dd78be656d2608c477a8afd90aea947815d83d7c355637b906eebbd11c27b9ebe3cdecb802e6b", 0x91, 0x5}, {&(0x7f0000001480)="3a6cb5939da126486bcdc66ee6faf51c50fb40284b98da907857ccf00152172f54a2c2ac4c436481052ac6e4f609a2e2ab7c3e2cd168c683769860207271d8e9933a2ef8640430c48eb52301b24cd07cf8956163c39fe443a246e80428ff3b6790013756040c4a63f410f1b23d737343e5e32cc98d9ed7d1f6c6c1bcb148dd8e7af552d5c57b0c58a9c29299ac3f63cd0dd1e297d522541172bf334217c1d81dee8d794893981459b0b293340921d5a8a2a19956963c61cfcd07846bd58ef9250587120c86da799f7c0d7a4103c99444f7256dd8048113bd455846e3378217c93c76f6f1e24f889f4aa2a7b815daf043873f77c0811d0070b8c1bf960c1fed3497b6312f1b66a0f6c114f1904ef74b1ce8526cde568b46398304cebf9132d828b65704f87eb359277c8cea65d4340fbfce2633e988c3b96f99d8d8075cb7cefe9a27c557bc750fb85cc33340bac407d2589d7fcf96d38a5096145cdeaedd01bfe84f445a3633acc5c24f85f67347fe7c048c41277c3e81d3c9ada558ac2f90460e9fd85f4c28029181f26f3f6c6e0136e0993d681c233db1e8502250a349061c6b71d05b049cea2e4fe912066985bcfa37d1d724dbdb1344fa0272c9aded48166096207b19bfcdbbc23843de466db2349573ca698142380f7bd90eff8cc110f43f5622951fec05d18dea4abfe6b81c1b36224efcab9a513ed6eba5a633f35db01233224e815664569564021c5a64bb6e26afb23093c1492ab030d36d8bbcb0ad2f396999e32723cc9554e87b8ada47ca2f342f90ded486bab4c307756364e2b9065084b6c14b181ceb2947c3c46e7a499c5963a4223da37bc97e194f89d646423e0e311d71bd1cf51e5d8243d9a4fa51bb29788ff211c3241d8f3f87498a76521ec7388d6ae0c086fd90929b614e123bc34dccaac813ac7929e113e2b0455895710e92a16c4de7cc670b51d59d74c6feb2cdd593fae8e08c7437ee3b06a4ec4cfc6f27db30263e0755ecb5af3c21312dfa8c5fad19f190c48283f4f52623fc2c29e84890e58e9ae1d20d73ba3ef08e1dc522eef7b774fd7891c12c6280bed50ba8b06be294bff401f06a1fafc7089b0051ac89b88ae226315d1ad0d7ab538ac0f539bc390a0c60c5372a71d6372001a7d29c126e1bf6e46925db381ffea2a38441262512df6673d05c5b7b1d4f54a86af97e1105d3c2bcd1deaac053e2b2a21200ce887f0ac3346590ba0f6846d5f22e94abed88a8b8f6a0faec1c1375b2ccb0a8c021f6434b3940b007f414bc584a457952b1c0512350595fd597ee53304dad6389a5881fd8cb093d5c21cda6b817b133f1de2875f69d7de0c4ea00b29f34af4ef6270bc6a6aea2dcfa2e61820421f1d83d96a31ab1f908b5fb4462dfcd6840cdd3ecacd61c8211b7f1c36163285adcc5675064b3233f8231f55e1604450dfa8f967df294a2a24d61a3c795e83cb90ddd7fd446bda804ef046333cd9c101ffb967227a378589ee869a1f816455d871f34c0a33d7b431cdc9f452afe98481441fdf432315a20c87253709a1ed81bbddaa79023d0ac30a54abc0202af10ad04bb9d1bcc925c37185136e1c61ab79e20c9c1b2fe1b4054ede49563289b25f7822268fe45d0b0cb858bf5e268a6eebd7dfce5d850ffcbca06ed03b87c57789e125196fe09730c6a403b82a6995c5dcd7aea06c62dc8c6c254948756acaba4ecfa56bf640e4fe592ebbbdb6207c3a4acf0f0d8c6861a1c8acacb321c8177ecf85740b811cb0184da38f7994797a5b0f1092b8d997db5c08396acf2cad474a6bbbdcceb5708bcb29befa78e83cafc8bca43bfc7642a78db742f178450dfce3ad488b67c045b056cfcaf5adbb9126feecd3e1988f61f4194081c216c5e971f394289b1087c5088cc1624eeea120068ef2665da64ececeaa55899593380d21adcad26668b1272b890a13296b4dbb1cab7abad566727d457758269766c06b9726e415f16037deb0928a11a250f073a5fbb269e54bf7a6c60c79435aa672d0266499141be220aea30663e9a62497fd5ccab21090bcfa704dc35c83b1ee642fa7c0e00df7ab88f45388cfa27e44f96bff380971b8f02acecb608dc32e6a8f7767d76715d99b0f9bdca6655ca7bd226303dd0373ed0926ad11c24d43498cd3036ead6fe9e6cb432229c8e8b8cd30914987a2cbd6cf0bdc9807eb24f19d06b78837d9bbf7991b5ef70f11f89170b11b3b161d25bc561f313a876b7660565551f1bf23d560d0bec75a3f65d1719d41230bffb48941e4f1858e104ab0c9956e4492904aefc21f470e1de808c47a5fbfcfb16ba5796bb03e660583060949036f9e7a94ddbd7a744c88fca4cb0136bd218641cfecff56193d6a6bb674c447db96a3905d2a7d0689c49f1acc7818f07881a014bda81066ce84f45db97600b8956644c2ee579b0dca6279c3960144e1a72ffad5db11a2fc9a12db7aa868c7adfbd477832e4ea03b9838e477d9d828d6828c9109e643af36d427101f988946c43ce344f7ea9dce289d4cf9bddde876510b63f668c93b850e8a533e1fbe95fe220142ab5c03d6627142c55cb1965109e0bf433723c27298baf52583c098c7bea544927932b9e5a299b7e72bf142d51f05d9eacecc5cce446829ba56a2a637af3c30c9fe7a465b6066009a72115939f9bb328d9ae45b4cff1bbe9599a5abaf4bb5e2a4bdbc9508fe04c38084165c52c0fee6bef0c57971b19f02f3be8d05f55cd34d831af84564059a76910272f877e713368cb6ba2f4f90daacc8835db511f1ae93a09ed1c2888a86cf7fac1fd6c3892a13d321517e691260644cdfcf4aee37ec58678b81fcbf37945cd1f19c0d227a69feec481d7ed0a885878fefaa84531b838cf55cb77e7f67bb1904d5c315fc72ecf8d4e091b2acae5ee587bd37812a7c284f7f939e29b9398caa034791a87e486c670abe9a941d482b616d8428221424385b3ebaaf0b2988725604b16076fe24665277057d0fbd698fa2ee844dc390285882acee2d79bca82b236cec706b8ef06c7cd213761d12323f71dd328a0c7e3b86c1ea15c2be073498371d8c98b79430bc670defd3d9cac5541404bb1b81c2c3175448a0bfe94ee2825dda5dedf2e766fa14708f0aacceb5fa9c0c2f12bda9318c717b1f46f50f11a021aae67b66799c416e5361fa874bf43ac525753f15e00c8c89b24db63f2bd386bcfd49849a4c24e51ddeb95b7efc1550d1c74da800d17a55f0928ca547fbd7325a169aac12ad5394153d0a1a6f9ed636400d628f3926a508533d97dee94dba78c15f5b5338c60c13584a456ebfdca5d39f758deffa601c3440ee8ddcd93448d05445e55df05afaa6b4ec4890f2aa506c99761449f9bdb25159a76ef01adde5f6cc9c9c622639f123cc7915b768febb228e618c9b1669b0f1bf182e175c8f838504ce9ed8eb166eead9f91dd84556c239bdcade15507639855ee03099c97c648d4b40060de090d89d0213050d8e2da70c3ca47cf4159223a7b402eac5661d24b6951e2d784cb764740a1c6f6a93f42ac045bb50821aa23f8ef61c1ff6f38540b7cb494bd191e6def33b8a77c737e0bae68a6b7a4f79e71f726828d6fecf84868be1d43a362ff7e4a0d2b75cabf4d8d683fadd745fce145be734a41edc92ea15a5a5fc2d4942b240c8eb749f06480bbe1ec5912e964170a2648ae3dc421de77102b581018b1264ca0b2088fc0cad81c9c06043f079a11bde879c1193b7005a6579716f393a467caaab363a39119cc93cdb8e89d41d8ca262309350174f70927b6535c5f325195ed6180c6db2b22494aae4e288e6b0fd0f5eca1984a81901ddc9283e7f2b550384dc9bfc545d405722fc176bdf8dd9ae08e95b49f0407eba3658da792924e883160e9079d78907d7a85c9693c79829f6784e265e1fef2d71c88c51edc24418265b6e968cd5efe9c1c8e964cc7654dda4550e334bec4a51061a7308b0d8496d36e0d133f2f73383cd757f229810e6f7ef6184662be20e51bb0688f83ed158eac95a65ba3aa69ea6188724eadb2b3b43295f4eda7b292ade322b826b0c0f25b8e26665c033343f4b3e334842c9f339126c9ccacaadbd2e33f884b413e70af0131704afe3c4a62c0355e680a586e3fe6250fb74fde8de19225f4731fe3ad9dd0ce398b5ba7ae8cec71c16760aeab3b5fd95258316f68a4a9bf67d750f3ac7e6e70be7a603a652259ab3524a629e52c91502c5e636335b44682e3d29c8a40831b4139f3cb5d46fa7a97d7558d73c05b43b424417bdb897eed5875b2d516532a073405563182f7bf8347443f23a2ccbd7a48e6fd0bd76cd6fa966265624a4c284456e7ce2004640e9c88ead16bfbd3ddc6eff5a889536edbc99a0f23c0430c58933bf43d59e828b5c9245d5d6cea38f53638cf8e95bc65a9d922b594ee02426fccd3a08527a64f2e052beed021cd6865e9f9001d8cde91a330ecfb4cf2a270429591a513d9d81fa69131ccf18bef16b5abe2772ebe487d372ceed7b8c36a1b42d4124a1c4607287e4612e1d66078f59601e7d95fd409e472aecbe8d192b9bfc4ed8626f30b39ff296f81dc03de5433b4197f2ea7f42254a1925e528dbbbd1c78d0f81bd611c707c6ce1215b08a8527825ce5675dfc005ebaf284be8da9ead3f3acd8a185c142b6b5a137a22400fea5be39d829f2f7cacc784fa024d6c30b94810eb396b0bcd01d41db6cc623dc1f432ac224e57c83c0096cfa3fed7878fd8d2166f750deaf26cbfe59431fd98dfdbc8ef7fbbfd6a33ae61a8de6ac237b480f7a779befb9f7621b6445f6b04be0b6688f49112383b9e66af43f67d21f5c2e51fe385807135dbc51c9e00844ee7573b1e0c18ca9ec7698f804c1429a5c747804a4624189d2d268b16899b5612566751dcf75690637c3f899d56168cb0786216a5025284d3563074dd92591ff6dfe31ec51ebb652d39de60ce369f7cd1d424e0334e589ca2ce33e8514d6f1c75de62afc039ddfb06bb59ea899ecc28634943723f8509671c304ab8d4a2bb3eb1f3c552532ccff31d2f52ae65f75080ef218ad7c132ff8528a2c5dec252485c5caffa83726d23a11f913f28564c3bf3e63ae1ca35e6bfc17b0dacabb8303d1957beb3959d1d68a38cbba38a5b956cff5f5efe027c4c2fd51f1599afa6962d126d0c547068ac25e98fa91633915faa85b12962ddeace631e044881ef4077d2a383e1a300c18ee2e009066cb971a64ef2c043181cc441bb5c902d49e4ec1291f9f0746ad6d3add32cf1e8f37128b8a4e494f27a8e5e9a215ef2ede12279f014f39ecd4ef86544a2546da13f5ab7ec521ddf20f6f7482e290ca2cabbd8c9e1535e8580d5804af175db788746175b103ada98ac7016cd015e7fbf672dd1ceeacce99e7ac89ce25e029f645cde91d3b1614857ed8fb1a12b9f3f23c0cf55355e1510cec474b6196925d9f46ac81ff7f84761381871c20071fed1123c01bb95377d870c9e8d69eff44d25914b13884ad08c25f3f65bf2c05aa770ffa0e70ee47f0f9f3f6f3949f609cecef49bb2513490a86a7e9dc5ac8143d590e55cbafa51482c1cb3732d958a1d1ccae6404918bee476ba2b13ba85172103e0dafb732c9f05e83c9b902ee10c340da8c6c3dbbb9dba8d6431a505627e5d6ccecc680aa9c58813b9a2a0590382efbc699a81449076606d46e961b26edbfad5138a39665bf8c860a0f5366c04f350e8c7d40c5a3c24ee0af925dd111fd66f0a03089f126c90e6764d21000e5d1e23a1c1fbfef0cb37e5777d5200817da", 0x1000, 0x4f1}, {&(0x7f0000000200)="8184b0c54c05c90bc6902318d9bc4daf6f4e3b4b80", 0x15, 0x20000000000000}, {&(0x7f0000000240)="d3f9ab841fbee7cf58c6c169b4a616fe0c04010ccfef95b5965ec03e83b060f4e19b958bf2f905db4a0524f4cf6450ffec0ca470a8ce59ef761ca7a84b37cfcf51a79113809a4e4f532147", 0x4b, 0x3}, {&(0x7f00000002c0)="54d538c39de97c882ebf158fc0dce78eea947927fc490ac7e85dec20bf5479b9992ab2d3c092cce50738251caccea7096156e0e9436fc77d2abac09700dc4e3058e43c1f5fdb0a21c7095085903f1289c6283fdcedade29f6e2e7f237bb30f41d532056aebd88f51df1365eb6e7fb7d80a3e4cda99bfbfbfc1", 0x79, 0x7ff}, {&(0x7f0000000340)="ce74f7294afed217abb4cd9064aa0f8e6c24189409724ff9998965aa0791f324472f969338714eb0b7eef236087ca73ffa97a5d7e5fee5fae499841ad69bfb175435a6e3c6cba4de586074afe5b98ecf31af198cfb6448de7999c4e672ba97af9eabecf71857fb784ab1b55cec345806063b2cf835239da727cfaee250d8c4b21ba0885f72133d00a48b41448a0d50f2d57c96f7fe2ec1b26c1d511f1c4c4d179a239f0c431837d7a4dc19b34b6c4d388b4fbfb0db870a1a822fa254b883642a6a1e4351c4932ccfce4258cc14800ab0850deb0d3f0fb352f898f033f04d31189a4f1afa5d", 0xe5, 0xc8a}], 0x0, &(0x7f0000002540)=ANY=[@ANYBLOB="636865636b3d7374726963742c646f74732c647df82e696e6f646f74732c667363797374656d5f752cef0000000000000000"]) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000025c0), 0x10000, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000002780)='tasks\x00', 0x2, 0x0) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) io_submit(0x0, 0x5, &(0x7f00000029c0)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x5, 0x8, 0xffffffffffffffff, &(0x7f0000000480)="de886ff2ecbedad64a50d2afa15b70aa1a0a7aab350cbc35bc2d4fa6a51bc09a9952e9a8de2adf897d0eb1d29dc1585fe9fb59753aed78925a35b6240fe8d49ae2f02db4791267b507092e8b3536c7f24b01ea42ee3e45980698ef917b69056039c35823a9329e9b30b78666d2662e397b803585059b8925a1fb7e3e9a0174b29274a4f4c8c4fd88c3d849761e8be2bd8970d23c925df4cf0a2c5a65285955dcf845845e6edf31c3f65514555821c734e952327b3ec3a15673451af321a08b01ef05377db336b8e1991a1483429189ffe68fba9919216f3ecd410c6108d24e1e7246eb14d0303b4c8435195f0508f90165dcd00702489699b61994422e4ea72201f2a7473e3df03d1df90ca71919672bea4fc07f7dac897d4d87de23f3d381dbd6d3e2fb2eb2c608fe9910879bde912707d504e4557b1e92883ce61c18895ec88d2a2a432c34e8206920ccdb6737a6acca5e2569ce899c3076b46f1f573d767d58015a5757ce7b4d5f79abb8573061c32c9ec12a576cdddb3b51aefa501326b981008cc2fc6b23029b038215cbe7699d0a608f0ce9f798ca54511c7508d6ebdf1787a673649d723536295f5bc2bcb52e5577dc156022a87f708a6f6fe90233ad5a4fbba237687f48ebeb0ef4d806c6b3093a8471d7da76260f99e2a121876c6b1ef9a3029091f284c544955f67f3b45b73e42aec4167dd4715ba04e06424fb4a481b299b6907603843dd32bade13cbb081523ddccef6e8b96382d128701ef34c0bc6913b274a4a6a40f5e3baff2d5bc348bdbc4e660e8391cbb6ac30b9692b8aed2b5828fe6cde458a1f48744bf31d72b3631356f71f583015a73198ec755e853539501228a860e6814864107ac8e89087d3ad8f631303387aae2051d318cbfa1616479f5437f55be9ec234bbba8720fb5db76c6b075fd7e38512792fd9f814b8e3714091f50aca0d482dd51acd0c936e002ca95b1a93679ce25bbdbc4c81ceef1ad9a8548febed936f6f142d5173cae2d90d5c13dc08d20446a29a9f64cb95927ad2e4d35d5623aff580f012c0345f5dbf13536608560fcb020a9bdb9bdcfaca1f84298cb732bd49d2a105c012b58e49d7b96685f0b5dd47d5dd1535a6915bbb5b8cff11286d782d4780614baf91edadcc660ab5d968817ab4c57ec8d4e4ccd0a34d18c7fa25a07c7e415b139b26b9167be325a709405955e1f6177c3f3151e645bab5193e85d7529214e4ab154a148d4f5b8cebeb125ae6e5f6b57e3fba4be6469cedb422a1b02d18b36bb2f653fd2d01afa9c1a72c97e97d0083bd41a71003adf1ea2fb9995679f052c8fcaa34b4ca9b3a1e393bb81225543a1358f224d21383a5922632df695f379dd130b258c498db3d8f2f225d9f92ae4f04155fcd1bdafb953d12c61c32823c77ff4905feac3bab7ba1844cea0b68b1bcd18d718e35c7d82659ad3d3ba9626107b6b796eeb25247d0da2bb73f29b5e0d9af95f34d9b334591dced1de5449bf8c51a95a211d1ef63a2aa7cb89ade61bb719279b26653dd380c8f13c4f1b4d5b41abbee041aac0b2342013f45ce970c2cbc57ad634fdb4ac905a9c62d0cc497390d93f8a8fa39770a2377a477ca1c1f8fb4abe69a5a0ad0f6631df18091c65a3521a6a843fbfec7c20b835e9c6bbe7b87ebbf0255bf02dfd2843f809f9b8549ddf45542ff28c24634e3615c253caaa0ed09d190528298085fac6c98bf3a2036bb9541cfd77b2d5f5e5cabc366765714413cbb12bd720a25fd4522c29e880c3e54e30aceac70c8698268004472ae0fc7a4b597c9311aa78fbcfc1d969f16f7538696d79e8a14ec35e48171644094c88bce1eb3f33965dddd3bf0355a1794d28914f4f70119be30643091a5b8e5efe98b4e83547f5137b45cc2588607d2ec3ad3e2bb8462be01c412f09b628769d4ccc6d04fe657cb0ee4bb8f5cdec861f31879bd227c6a62f199b2f43f9b9a7c0a54aa644e334a99f4a594f40944a011ffe7639fe1005b8887f7c736f118e76a120c8b2fa3ea7b9d00dc9214dad37d844cd82ccce30f5a390ec57eb3083b38d0e8e1673fe5708474510f1800fa0cafe20c9f4cc5d1b4f6da670fd763ec8857bb1a11162d6103818a136173fc4c10de7526936fc7acffb166ba9f1bd5a706d9ff3661893ee8a05c65bc74766b7c97b9ddc917f01a7da2320df5d542c9cb25495ea14c4b9da9efd9b36c386feb76a7b433b9f3f029af4f765bfe0ea91abb2f67b7b73770d8290a56de25993c096db46bc5287226033ddc5a7dfd636fc863dcd2e1de44fc90b43905e0e3d99c394a389fb313472dde87078d368d513c9c698886079ba8f9436cc87fb7fe24df44d11ca98fb0964d7f8ed3e56c6be419479e85fd3af051a2d5325ac2b1ec553fd3b604edd92ef7c095eb81ee86390c0fd4261a193c2b5904e91480629a04599e845cce5845a5701a64d3ee197ebdc8194b789e8469fe1c2ef171c84f40e537f64a71ee18e971645637d419578d78eb237f7f9aad3a23921b5b86bf4560698a71900527a67574703f8d942b9f753802b969dcd8bcf6887a04f9ec1e04b4960e34ef2653d4837ed7f7d0df69b754e0cb86cc974a0e2a8ace352ce4b1fce85623fbee4d8dcdefc3e59c63e2e7b6c7969f2ba419a22709c4f026db9b071d75158d105be60a6be9e931db836852c31add29be1dbabe89348baf053c828a40f3046a8d2cc1c3902ada24cdee3a7dd23df8626570ea8a0299794be4d0c40e351d20b8a661cd9658d975c4345e59a518d485ff45cb364d6eb295f5c8108c335ced6ae49b5cb2ee7c1c54951637658ee35433c74dde1fe74a529a5fe468a82e781e2452cc128028a0745161bc0001cd50c748bc6ef76369583af5fc93fa124fa6686a0b000e52ed1efa12505efe5ad0e85435d83d79cb3e089f66eba024fe18aff0845003a3667cbac995c54fe6aed2e86bc47d7221777e1eeea4850558e460e3dac654b7c2dd65bf24cdfa95e21c9628a78761f992f5177cf4415d2475044f5d734c1d0a983bc38fe021b51aa48ddd05035a5846eb813f590d3624cf756342062f434d0524b57ef233287bc8a47c08d64ef1ad75385c298b57625afce6f8814c07c7346bd325564f3b1b9f5f12ad2e7c328080811a3e9088372e6254f8976f95fcae12389003c60081f9b3c45f180969da4ea77104d538e607c54dd872ffd536e179130c1eeac9770af8e7cf733c8d9ae3f23d9a6a987d6390d5f436fe6ac48f3d2c788024fc41327722b6828f8c00d5df7469ef26186c294a532749738ebd7afcadd45c9a482383be0f8150841317875dc89d9b8c31fae6a8e5b4c6b1aefe23cda3cab7f40f80578052fabcd9623bee5cc5f9d4376d8aafe2b6d9562c9161f68231f901fecaab8cf16480dab890a3b49575f576e760f8ca085a26bef6b282919b119f476d4f65b2d7e53e05aedf2a96f6eada09ac6ec3998d016da8bd6678e12c62fd9bb2b61a194f3cfebeefcebf58d296e2d885854c60142b326aea19ba9391bfa0ec6714aa8a7168f9f5cd4b5a7a63165c3fe34e9d0a8c210ef056d9690c7e34cbc442c87563b02c833c12e0c2033f43de83f6a8fd52e056ddb89381719abb9ca89f6800f156d9551a5290937399052c7243b6726af3d87cfac70eb2d8fe40c40fb6920494887ddf695eaef27201aeb3fba27c7182761e0df3e9f8a29b25bbb084a01ba4e27f481aa1c4c88effc56c8a12c21b5d67cb4d8cf6e4df2918a45867c5f827147c74c24315d7a0fd79c63c6a7f72dd3cd33af3dd14a5c8d1309448e57998ed641bb26fddaa0d6dd99aee661893b0bedb5e54675cea96fa0fc3056d5ba29cd7122de86787a74fc5438f20789e6c9090da330e5a9c6163c32f2c2294ffa18b0459052c81d935d6e8c72ecdedf9f68c7d967db7b0a6387f690f5179cda02b80f56240c03307f9b37c5fafa7fe1baa04107c43ccc61b296a34a42cd9da63bfb1a94ce8286e7fa5f055b20da42b4c1db2ddf89928854bba02e9f0397037276502578c72eced9c3149ef182ca34ce845149bdafaac4dcba7dc4e8439538ac1b01a9d35f88d7f05dd7726864d7f27e95aef48990873454c41903f9d0e3ce1e50a47be5c9feeee041f7670effee818b246fc10934dc6c7e98c99565e78667400c709baf0b0814a752d98c8e0689e5cd680f5dad84ac49814945bbc5bfd689230d087c04f32deb75219c40935fe1fdb572fd9fa51b200af30ddc3e1374a115261a05b5b3c673462eb7729f466e3b1989a6688ebfd131d86a8983c896b58c9ef7d3153cbd359459cfeabd74e93a65864a7b9d7efb8fbcdd190b0a719e540dc1afbb76cca2a859309c4ca1938e40d0f70bd3c4536f5ad0c53a0ea800a10459f53cc3874d778830a917f41775e447aac9693575850e4870f1dfc8c882358149ae818bc87dd014ebac8c0f7cacd108768a76945a6b39a88d8d44cbe60f89821090bc088b2f039ffe1d85f9ed233b32613595438b0ba2950685bd8db2e3949ee4fac2878e900a51bcb9621382b8bc860271a6fb3338b3d76de9f3e5f264b5406145ee186acaabd4792df49e96cdaac2169e2a4f2ebe5280a706bae46f8ed11da4687a14f56fe76d68443c5087ec15afd768bd1e48d883e675b1177913ffb350b2c97122343ed07bf72fb20b5f6162459ced2733df03f1a27b0a28785a5e711a903a4074480ea1da1635578e075eaa915b97a778c5836fd38e02f6b289d38551691ff1248409e4c223ed59977c35738ee33994a48a61b452043a0c9eeba86bfce484cc2144cba91b4ba0707aff8e7d30012b6921cdcf420ce14c5f22b3c6ef9ea51dc671afef39bb2f7487a3d0412f63c4c45197366bb8962753d926288c26d236d3abe66804d3d164e048d22ba3665fd2b27e13d04b3fb4169874e0d86afb52bfae8da7a507973cae5d47ca575ac88c32e0da9d0cf35b3308cdf20da18f9e8d9134efceca1487506e8847b24b7e8ec09f308ce9d5fea4c4dae6dd05e6edd39c1618742db9f7e48bfa1c04f105a2053d367f318180e1c37dc57978f8c6252139cfbffa30afe3f61f8df12cc5b8edbd531745ac3e14ee2ac1e5094233cc1bd24ca782b2ad2d7849e319bcb96852cf42c06af2c55ab344da159b8d76dd6013ebff2cdb0daae0489649acd325c913d4e3d0822e0069a03f5b66f865ab7aeb9ee28bf1b0e7dfee70789b3d7d9901b54206bf96b1f18ac41e4a0a81698230a4724689580088d9e4aef4e83f3f47f19b0cd3d09c9f08206b774c43c243a811556125b00d533e4790a15f2b61a2a8f08da97372dc3542e812deb024c9f2282ddae1ddd91deee966cc10935a518ec6df30dcc2ffc326777bda6daa8ed52c15f995e01c73bb61b71b79e050607d3dfa60bea274d50ebd14a8656ccf5275ee01f656bae2678224979b4b2cb63cabb9170fc671e737d8f90e29ee02639e2548d59c54890b62bb915aa2aefb5b9206215aca1fe2caaab464a0fa86b05fbe943135cd680520f48adc15fa9983c0d2454e99d63ec35987ed540eecadd2ea1154d54b802784ee740ac3a24977411a719b4ff3b3d996303e239928ac625d43069e332f22d53b9370df88d57593a8e06df7db01ff66170029c3eda5133a9900f8234bde329a0708b75568c04cec149298e433bda89fd29127dc76750b17d3ae4078c1c55cb77c48198fa3a6f2d84c9adf995196f96f0a44a19d6f861fd285a7bbad2bb4ef6c57aff8d26f0ce07fad3e0e6e1eff409dfb3fef263a748866b99466f9f11dd2cbbaf433839b64b9af", 0x1000, 0x3ff, 0x0, 0x1}, &(0x7f0000002600)={0x0, 0x0, 0x0, 0x2, 0x3f, r0, &(0x7f0000002580)="a78586406a5d5c328ff8dbb98af113ca3a91d25f47da7eb2893c2680d1fd4d1a765137", 0x23, 0x80, 0x0, 0x1, r1}, &(0x7f0000002740)={0x0, 0x0, 0x0, 0x7, 0x20, 0xffffffffffffffff, &(0x7f0000002640)="4acfedd168c37fde78e6487f0b2146ae466a227fe3b567b7b2883c70d434986024ab277fd84d2598b77cbb55337d981a82dcfb5ce470036fe125347df1a6ba894e498c191fe26b322c56be6d4463cd1233bbb1d840119fffea12680d073bf4db06c0efddf507e43e36cc8330555151fff3fc4a96e5c5b96d96730ce44038a2047c466856427323f768966ecec8e2b875d7c1dbe2ab3f969924c145f7be58df3220fe053ce1b9b6d7115c4b0532b49cdc69bbfb5d101b68926f03b0fa2bf45c0fde29339dc71073a545b39a69985f0ff19bc6eda811d93bc7", 0xd8, 0x1, 0x0, 0x1}, &(0x7f0000002840)={0x0, 0x0, 0x0, 0x3, 0x100, r2, &(0x7f00000027c0)="3cf4de7c3e8cdc13e7ea3542199486f0b6d85d47c6124cfbef24d6ec27c227ce68a153667970f2fc7db661b539cc01b2f11dd713b11916e736acc912d6521a696f", 0x41, 0x2e14, 0x0, 0x2}, &(0x7f0000002980)={0x0, 0x0, 0x0, 0x6, 0xd69, r3, &(0x7f0000002880)="d87818c631836d86f59eb6d3e3d046f9dc1c0c1f64a8a80487f73453bba1732c2d0bf972fd216ea3b0be6b6b66728b1d5bad5d9006b3fd4dc801069e298c18fbeb54be2b78d31b5ee8fa6970a8922e08b174e7f1db14b77c1dc9f0546be3fc9580dd5cb14a213938a33034a508deb9b15f01e8f0c753940a1ea90956dfcf2a6dafdeec91b7448ff3aa56325a1789b911735a8f57b33297ea29b5803d5e3eca3cc8eb9a96c391d23eb9f01f5fd4d111056e4e40b8847b35f4de4a72864a66e182b9e395962c0b1ed2cb8fccae75d3c6f2576b9300acd85285a2dec922fa231e664cbbb71b899afcdc079289", 0xeb, 0x97}]) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r4, &(0x7f00000000c0)=@known='system.posix_acl_default\x00', 0x0, 0x0) r5 = fcntl$getown(r4, 0x9) syz_open_procfs(r5, &(0x7f0000000000)='task\x00') [ 1723.629392][T19085] handle_bad_sector: 20 callbacks suppressed [ 1723.629406][T19085] attempt to access beyond end of device [ 1723.629406][T19085] loop5: rw=1, want=256, limit=16 03:11:14 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000014000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:14 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140), 0x2d42c3, 0x0) close(r0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x101, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f0000000040)=0x46b, 0x4) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000}, &(0x7f0000000100)=0x10) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) [ 1723.691702][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1723.700050][T20426] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1723.711532][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.725686][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:14 executing program 2: io_setup(0x1, &(0x7f0000000000)=0x0) r1 = openat$incfs(0xffffffffffffffff, &(0x7f0000000040)='.pending_reads\x00', 0x206000, 0x132) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r3, 0x8935, &(0x7f0000000000)) r4 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r5, 0x0) io_submit(r0, 0x4, &(0x7f0000000480)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x5, 0xffffffffffffffff, &(0x7f00000000c0)="6004229ea01f8233a953bdd48ffe3d22444396e0acf20c48742fd69022d48537cd6a3d72b4d8089dc1aa67a1c54ced86d7ce4627d164ce72461f442d362b157ee92f5f16640aecae185095a9c3c1cf5334e8cfe989d5360a96eea124452ee4c8723a61d731c4b17d7902e64f17c30bd405bb9eab8e33eeee64b7e1627b756a956258a1342b41d07fe2ba3397ed0ef7ca9667a14bde4e5bae817ac51a20a3d6a64449a696", 0xa4, 0x4, 0x0, 0x1, r1}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x3, 0x2, 0xffffffffffffffff, &(0x7f00000001c0)="63fa2fb6a202700ade651c09555093fd35584451cc3e915575a50b0acd6bfdf474fc3dba2fb090919e978c7dee07ffd55dcee25007f7e2f3ae6ca032ce4931db03cc846a250ea6b3431617723c0ab03a846c90f415bc26530fa64d4422da9270ba54fe70c7e44341b2d1e7e980ea50a2ea33bfb74a3e1f0392f78cc2d5f15d74e8e5752af5360ec1bd832e294e381acd8fdfe239986f55179ecc358cfb29709e9a400f114a9fafd91a9b1ea59f3b6a375ae68a42b96fa90ec8a20bb701", 0xbd, 0x81, 0x0, 0x0, r2}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x8, 0xe2d1, r3, &(0x7f00000002c0)="d8d7c0122d5a4ac48a052231d17f2d2155498d12e0508fa1160374177dcdd4cee67df1e942a9d13b0f342f1cd865e2b91b7ff907415229ca89aa7a7c6c0102dd288d4c3618788507957d77d4f50eb8358e5a14adf19ced04d38306f28a4557ee958d5cf2c77280e6d274774901369ee8caf92567cb278e5d7f5c101e5b44790b04b4fe4e833dccbb970cf4b2fa924153f95e3972787a203c428aaa0b524cd2e515b7032c", 0xa4, 0x3f, 0x0, 0x0, r4}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x5, 0x3ff, r5, &(0x7f00000003c0)="24ec29953a1d08c41c2cdab20deafeb3d3805d85cb60be6221f84df6233dc90e", 0x20, 0x8}]) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r6, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) [ 1723.742085][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.747904][T20432] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. [ 1723.750151][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1723.815144][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.823163][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1723.834747][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.842778][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1723.862850][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.870837][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1723.882558][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.890664][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1723.926577][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.934716][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1723.948801][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.956822][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1723.969549][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.977649][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1723.988889][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1723.996891][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1724.009267][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.017314][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000001324bd7d [ 1724.036870][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.044865][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1724.056033][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.064041][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1724.075251][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.083415][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1724.121580][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.129787][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1724.142068][T20447] loop5: detected capacity change from 0 to 16 [ 1724.155768][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.163816][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1724.176211][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.176569][T20447] attempt to access beyond end of device [ 1724.176569][T20447] loop5: rw=34817, want=184, limit=16 [ 1724.184362][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1724.206364][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.214465][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1724.218690][T20464] attempt to access beyond end of device [ 1724.218690][T20464] loop5: rw=34817, want=184, limit=16 [ 1724.225971][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.244549][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1724.255836][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.256593][T16800] attempt to access beyond end of device [ 1724.256593][T16800] loop5: rw=1, want=256, limit=16 [ 1724.263834][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1724.292818][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.300877][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1724.312823][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.320935][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1724.332721][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.340725][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1724.352177][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.360227][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1724.456298][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.466505][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1724.478374][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.486786][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1724.498284][T20426] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.506305][T20426] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:15 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xefff}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:15 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000120000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:15 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000018000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:15 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) sendmsg$nl_netfilter(r0, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000840)=ANY=[@ANYBLOB="98120000040b05002bbd7000fedbdf250200000504002b00c49f9998abcf291cb7758e0473c1d1c90235df79538f7ef65b910f2be7699dd43044863810dfd5954e59eb9e8ffce731eb5aab8d1e26d2b3658a6dfd9e648bb31d6aca92ab56f3210608f19bcc0b97afc7fafc6c30c9c58d35036ac4da7d846bdc421ed8896855988603e5ec04cbf722be170c5ae614c24d45dea0da361e995071bcceeebca28da327a26bcab31491cbd767236974b96c53dadaf3fff8e455d6152a77a524026af4a37b7d8b013cc83f4c9378718cf3d50c5f9cd00f2640d46457d5c800260b177d5d61e542456b8031616d2f8ce707de86035797ace10635a2f8dac791ced548d3407c0f89d5c640ccc1ff06510f6d80e84de48ab3e45452f7825ff4137e8c7bb058f9cf68a87f33481d591e8e5b028eea8f7816ff56c6bba9b2267cee59c1b239c8a6b90cfe64e44575c55359aa563348e553b3ce560ae1a0f92e886325a78fd84c4bff5e48a1a3ef929ec2db4fbf93e7f649858ff58733944c229cff266032cc3bc0b4ea42df266b6522fa7abb8cba3a8c30f5fd641cb087555ec6996abd0935b3a9f471f79c31ee4d2009ee0de9dc3477c6a633e268742e773790c9c2164869d0448ad0386dd16daaba9fda9ccc11b68331ae0d094d071a3e4b4e65a925cc231d13146eb6cf4184c4363f68f0c98edca48c0b7eddca40f345cd035b2e83606ea3eca2ca8ed7eb87e6e844405b72755f557bec72c3dfcfc3f1d1aab75911bb6e2b091489978682ee0f3da49ec65cc1cdffe250f8aa7aa6342aad15bcef9e04f3a57038d145b41bfe38d4276f9d5c00946473c7a6afcbd52747b8464bb77651f9b15119ba7fbe0f8b9e82d71e683eadedf2c7fee527244c688f2b376eaa78db4b5c844ef850c75135ca2c9bf08fa5578e5d4beb9c53e0b356b0ec5a0a5a9021089477cf85fa4c4e9ce100ece5c03c716fc020a692d582504f5817b3b444010be23c6862733f7a183b2973a4c09287a47d6c3b08644ebdd8adafc8922942f26498ba691db3d9016fc6314ba5357a6b721101bded4a8d501fb2409324fb0b7e6cb67e0f56be926f95175a693777149ad63a4897eb9aaee3ae00b25e8d6843c66719dbd306edaf8c1f1b576a4237aa2f1d1a0bfc183bc96cead9c4d73ecba9ddda1e2fe52495632bab07a1593afcc4ce25084a3c1d19d77b5713d80065f544e52f411074fd9d6cef9897274d0a56b9375f9fde3c05fe0ed1b692eb929655abe4ee05e6c12fa6655b6c69c1aeba927039626bc47284a4bf0c70035b461af5b141de1f351758ea003826291b034505618dd8075c4746258fdcec48cb6a64118c5015bdbabf7eee347972e2ee1bf30273d8e8012cc2f857fb720e645dc673ca21c553df3e21264b4474293ecfaa434db5fc2df1c8b06781d08a89c525f8e510f283a126bbf62fe5e7be3e6cd3498132e5e7b2e37d25433927079e0c4feb32f98e5d03a77ed36724087f5158ba51382a34547cea4a89e1103ab7a65d67a5cfeb5c77523b2e206bcf0b0af0af1003402f9438b57fab3b630260a31ef1d4a5b5697f243cc8f4ed06abf1c2023dfc1d40c167ba4585bcfce7c17c3bb38a68d204636774a68aa9f3c59c8491c0c5cf90315cb26db1eee736b9da210b8f9717d66aaa31742c08dcfc43ca59db0aa9d882b6b852b2d64393fdbd07b6d6606de2624efd7cb38789597601c5e49f678bcba289cc503a3d0785b8a4a61381e1010e258a9e7b4f2344857aba491f4ca7d991f9b6026f7953b12a2abd7a2bf8cad92a2ab49dded605c168983661cd1e266bc512dda54c64f2624662890467370e978487fec633f0c9ef4bdf9982b34042c77ff3acc48132db70e38737b6e1e02d01214d7a7a1c99ec3653683dba11aa7dd7a90cda4957cf8954f81c6bf8202abd304234ff4bad00ee398f02faf571f5bb795a0b1dc903565e855fe088b58e9fc3b49c89868487cfd32158c3ea964d9b570bf4aa09af92858fb287c22f8f096f6b849c0d5bdb398c8ce1d30ccc1d05cc1231f052d22f78567c7744f9161b45b0efe3aa3e78fb9e82f3e6b8919a29f74f6d88baecb80734db5265c55e7410979b31531e61f734b03e3f24c9b45f09017feba2b0c9b8fad7debae8b70a1f7a558f50021facee67444e9989c88215beb25121e6dc702f162bb6de6209afbec53dba67f1d52a236af66121ad21c551bd7dd91afcb2778a719e1bf1f5b1443794f4c2a5a08df2bdcd8ad412199109d27c2a0a1efcab659b2f77498ab5e7bae90d449a70a3d08e1dcdccf9f5444a270152b75e97917ac366e53260e36b5ed23b22fc0f010a648c05ab2707fedd58c7049035e0f77e06d4b4bbd804ba1eab39d3254df3f9beb0c3956526e5c0bdd2f2913a99f91e7b88dd3df014f40c371c360e2cc024bee6d6a5bb5253b51f71654ba507de48eeeb00eb00e0b5e307b0e39f521765aad9d55abf4f1f7bdb66fb598bfbf9a2576001e34fbdaaa1622c275a838f8014911603791b73e96f04e797e4fbd479555f392885d664411a1a912c86858acb9413be03482a6dabc9b23f37d80b74a265a54533935ff673a43369a766c66c643f5fdb28213c1506c1c25f77706c8d56e19c9b369944f52c47dd863d444f83fe74f5e448275f0279067d0bf34d1d1cb72c6b0536b5ad346a31bf5b3ca6d32c6889c5f61b18788a9ad5fc502f4bf854ef623fd681fd105186de0278e264907de67063e119cc804fd154c43b0e86e8f4e4cfcbcba3cb8b0ded35b039b9d93debb265572a60b08828eaf0022d9b39172c7f217b9d19f2f46fbea9b23b7f51ed0133a6a1fc8a75866f88af89056073cd36a0b2bdb5cd7f636fe2a50a8dedbd891a04680ddbfd0e3f2bf7372d43ff3327a0954d27c307554c4aec40ec7c2b91fa1619294443e467fdd102c30d014abe21ae811a029b79ef0032a2871b1805964d1b0c3d96f864948b93a7b2e358325bc5cf6ee32a018bf2d937ede47caa16818fe6e2e6329fbbe288ac397ae0674ebf590e364f96dbc0b956752e2fe4df14a20be35972935cdb60d9172bcb536c7c02f791aa42a4c1a993a3ea28b5c6f10274828d49b107df6474bbdedb5bf01c0aeb370ca8f18e5f8c7e67b0c61adf7a22c970f5397f406e9b31e859d9e62af484e1da90a210fce8a424176d5b4bd46e8c6d7539298e238601a5f79f96c6a88f9347567d37149e20025f2941488c69a7b09a46f28493ac7c669115c996c766c860e04fc3b4fe878963da4c2f3fec43656036425361b90b0d9aad109f9ea1605de1773602f461182f43d067dd87e6cabee5ea1038142cf4d7f6383f20ae7ded1772919146bd639e97dcb352353509de0bb2b6eb46e4fffa2e7ba665c3a7f1cb138f1155083b42205a249146c9c6540c0cedd34a25a3490e9923eb26023fe06f1cb81f17ae48feb8c6f03a564dbb5f35fad2426e5cd1091ecde3e6a8a9abeb153e616f01d96ee64c3d78a869e825b9e12d60596e35819dd5d787ec81e1b64426d3c73fe52821a48576234866528b9941669b580e431a670618011daeb142579b04ba84c2649b6865a58412f77d7d993e8af424c43ded9af5b8ec83aefa960dc8772e988e2bc24f5f4f47f29e02ff46011fa19ecb01280b28e839ec0336204119de9f7763c175dd5624008e1dcf4850dcdfafce786aa9965ea3a5ca3fef8d10eb2a31b220b0ead1e2c2575aa822c6b80bdbd5fbab95afcb3f9ba61bde4a6d634dde3fd95780940bc30183c7f15203936df7a48a286f32808504c22263498cd35556ca0e82cc40a5e58789241dc88a5af975b2063b24ebdef71c5b7bcefdff9fb768569812dc40fc0baabfbc1d958e27962cbff155e4bfa085081f0054a36306202fedb967a58417799690dd62af119b243a76d3223e9ab50160d6fc60911ede06be6893eab886be29b0aba407d76709489e783d120c15a348c9193ff1d3d96eb548762c316d2e7cfa8136543375157687ea419e8dc8ab02befb81304c78e9293a85017c2e6d1225f3cd0c50595e82f4b0a54b14b18c50996358caf82db496f1e07026054bb07e47b76103ce0c877cf6b89bc578a5a444964d49536d233eea2c816bbc24be5f933654a376f24b1d36b0c8ae15812db839a0195daf94668ff363f14f6fda8c1cd14bb0c9d42900ea3056913a40db4697f8347cdbc0c944cb4578726b07434cf8878a76d3d0aeb10407deaa691e41dff7db3a2a86512580c4875a3a253e14fa9126dffbaa9966ca1af770130e0337df0aee93b19d81b7e0a19081b8dc5a8e816b3d537bf19b2c4a1bf054d9d901d7efbbc2a48b0c96544db2c37d47aa0d791681f262e0c1728328178dba9b15a2e461b20b0454816eb735eaba3b494e2a26c6af6c3078e144e783d7122b90d6de0fbf48d5193df5eabb029bb51df96b2a0e794df5b53ee76bc275ab4dd57cd594eb42394a73ffa3e4b2c9a294446ee73353a468f4a4e6953bf16f2284ec4c22098726e76abc1e8e8f79296b5f4f8e68267843a39590c519ebcc64afe0d043a01de84435b32fee559414198dfb1b81c3ed618c3168daf6d43568ec0b8451534766b2d9fcc4c6251defaff81e6754bdea4375c273039f3cae4e42778458f551dfb066832d12ace4beccfdb056ee4dc6dd1d86031fafd31b3bc19e7f6bfc89f66be395b26d4a3470d76c6a2a49baa7bc2f7214b32fb7cd4e4ac9b3e9dbd959a9069b625dd622776b00c2c7268b1daeea88cf0a8ae6ca849ae55fd0674786de76bf224d6561646d914edea479a2b518e9f969c8c84506fec9e999f19369a5febb71a83d1a8ff03d7f58275c954f19021ef201c55871b644f536f81827df191b2faf85c11b4f6bb29f67c6876a594cbe724d9f37f5390d5e892bdee8d8ab6010f5da7dd705933cf8e990111980faa1c04169a56998c37d6a91f123a09c9584b4b7463c9306d0c8b6234a4159a7d73705bd0f6b25126d32186a9c0f3acd2ece3003d26c712efc131cfceb42b4d16be84944c0ba3c835478c276b9e7cce7e0ad808807b9641dfc532caedc05066ac5e36ef5feaf308e39f7c00841851d6e31276511db71510b8f6ae2549f6f49787135147fe81b96f484b51d2105678ce21efb30bceec0ae1478797b211b9c4071f7c83ebbd14da3b8a2b5df5f2d7b28c06af68ff2ebd059838aea910b5f3de7a456e7eda8c8ebbfbe0cf2d1fef1dc4f732309b518c0d7637863750ac663ed2e02e21b626a5ad64c70887fe494e44e4a5e7c84dd94505d5f7fca524b5374e6e1848dc9597c20e9f625fb487be0545287c5cdcf1d96d555e8a2e2367d0e75a3ed4330aedaf29beb9ae0fcfa75ae4c5f3bb17c2bc38328c697920d7d2950a6f91539a62d7e5d99294baf14c38cd836e8b8a664b23b2be961a8fe72378467170acd0159e3fb2f447669459586d74a01e445f111ef1637b55cb0882c52001ddef7f07d3cd686e450555134c50e2ea690a3e2e6cdd16687f32f4e9fc406319adbee0217e2d06bc20eda74c4cec44c95b7e3ba1bab6e81bfa99e66001003d726b6cb97a5727a11b3be64ff83883b5839dcd41327c37eaf90f3442b4995e0845dd2c1b802db91d1f43de8cb614942e80fef2534557588c091228da73baed4f611337288c8ec14946ed6fe1826a486c91c34ed657a4b298c85cb245e03851538c7d308b1e8d7dfd0ee0f979bad5958272cb3068ecbcc5c4c09a221acb63067ac151512e7a50ac8ea35d1c8fe8ccb1adcb37c85e1ede4063d74381601504250bc7668480238a105737c958fca41c1f0a115593aab6a97dd97b37681096f165e3dfa94423d0c005300080000000000000072026e802b92d257b451b51aaa48ad6cd2f33cc8a753c3baeaf79051f3cac73e92c022f1fb71bce925e08edc77bd5808c3df673ce906d79ae0238f30b60b13f21eadd94b1d8c98f8932e790fdb20cd4afea562394d9a21d6c18de2fe97dfdac3be092b8b65a64d3d0c00180006000000000000007f00720072d40ad03216344eb7e31c0f77e737b9af57250be094e9aee7fb1311ce62ed8fa13490ade7bfb764796e1d3fb04b40f9645c45228fa57f852f277e571d652f276367657bae60b995210c264b8bcb9ccabbd0c80670220952ea776d23f86db08bfd28ef9b71d0339e1061056a8c0c895ad0f4b9178bcc1d9adeb48f0027d8ea2b68a0b2036bda43bdb162134a79bc668de1040cf1acde0978a4e0b221c414cdf3bf966a340dd419976cf3dfb6aefb14f7c692d36ee1fa483a25a1d757b925dd5d7f3078e0647b1a4199ae50bb32eb5dff80875dc8ae9f27ffe5da9464512f6b8c99cf6857c265a4265975ece5a71014cffc701ac9704163b58a6b21d6540ec3449762eb5a2ae0d80ac8f3a88f9a97887fc30a797a0078fd93d5b9f871b233b6dcd5d2d179484456fade5212c3f6aa196e79e2440bb51cf235c17eb3812c495ab6fe7c7d9e55cc0420399a1d0500850000000000a7d65e32a1ee98d1c54b2420b719c9f44ce77b73544bc7926d16a1229c4176fe8101c19ee5986b7fa91dd22b9745bd0cde289fa1b6b353ae2aff331aaa16821ac1d90a7694d7326eceab8dfd1a5d8b5bf265a6351773a32433579201361ca2764409ca0db45531d759b3a5de8f09156630e4e636ed3f609554466c2c81a86f84a178aac935c99aa2dcf0a6399e4f4e49c0bd806497a7e983879622ca31d60b889ff046b9c9e9bf00"], 0x1298}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = fsmount(0xffffffffffffffff, 0x1, 0x14) write$9p(r2, &(0x7f0000000200)="a68a002d4fca5f2dfe3e5823d53b075b1cf5b50cf197ade5a63c81e2c210340922bc0c4ffca1af883bc00d1a9c01a99f2839b4c2ebaa76db0c9fdfecc2680643b8579a86f887988e278046cd0c17c29d0f4df98efeab38ba3fe235c2c3da9f3af69cfed67ade888be4e25c600c4456673c5b19fb424d26cdc398454679790db040", 0x81) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000100)={0x12}) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000480)={0x39c, 0x2, 0x2, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@CTA_EXPECT_FLAGS={0x8}, @CTA_EXPECT_MASTER={0xf8, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x29}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x1f}}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x36}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010102}, {0x8, 0x2, @rand_addr=0x64010101}}}]}, @CTA_EXPECT_MASTER={0x40, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x7}, @CTA_EXPECT_NAT={0xe8, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x38, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @remote}}}]}, @CTA_EXPECT_NAT_TUPLE={0x58, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @multicast2}}}]}, @CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1}, {0x14, 0x4, @mcast2}}}]}]}, @CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_NAT={0x130, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010102}, {0x8, 0x2, @loopback}}}]}, @CTA_EXPECT_NAT_TUPLE={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_EXPECT_NAT_TUPLE={0x74, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @private=0xa010100}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010101}, {0x8, 0x2, @private=0xa010100}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_EXPECT_NAT_TUPLE={0x6c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x11}}, {0x8, 0x2, @rand_addr=0x64010102}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x103}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x2d}}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1b}}, {0x8, 0x2, @private=0xa010100}}}, @CTA_TUPLE_ZONE={0x6}]}]}, @CTA_EXPECT_MASTER={0x18, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @remote}}}]}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0x8}]}, 0x39c}, 0x1, 0x0, 0x0, 0x11}, 0x4014010) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) 03:11:15 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000000, 0x8010, r0, 0x654ba000) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000000c0)={{{@in=@broadcast, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private0}, 0x0, @in6=@empty}}, &(0x7f0000000040)=0xe8) getresuid(&(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)=0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f00000002c0)=0xc) r4 = getgid() fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="02000000010000000000000002000400", @ANYRES32=r1, @ANYBLOB="02000100", @ANYRES32=r2, @ANYBLOB="02000000", @ANYRES32=r3, @ANYBLOB="02000000", @ANYRES32, @ANYBLOB="02000300", @ANYRES32=0xee00, @ANYBLOB="040003005c0a000008000000", @ANYRES32=0xee01, @ANYBLOB="08000200", @ANYRES32=r4, @ANYBLOB="10000300000000002000010000000000"], 0x5c, 0x3) 03:11:15 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x2a000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:15 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x4000, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x5, 0xfa, 0x7c, 0x6}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)={0x6, &(0x7f0000000200)=[{0x9, 0x6, 0x6, 0x101}, {0x4, 0x1f, 0x5, 0x20}, {0x4, 0x62, 0x5, 0x67}, {0xff, 0x8, 0x80, 0x8}, {0x200, 0x9f, 0x6, 0x80}, {0x7, 0x52, 0xfc, 0x401}]}) dup2(r1, r2) dup2(r1, r0) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000180)) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$BTRFS_IOC_GET_FEATURES(0xffffffffffffffff, 0x80189439, &(0x7f0000000280)) ioctl$sock_netdev_private(r4, 0x8935, &(0x7f0000000000)) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r4, 0x8010671f, &(0x7f0000000140)={&(0x7f00000000c0)=""/68, 0x44}) 03:11:15 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000019000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:15 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000130000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:15 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)={'#! ', './file0', [{0x20, 'security.selinux\x00'}, {0x20, 'security.selinux\x00'}], 0xa, "095d72b2783210a30b04c7f4c1cda9d6cd9c44767860a347d20e92cefe4a618af0ef85897e13e45104a6c3b6d0490c12abd6815d8ea3c4602ab24eb5131124109e44a688202da8b0b6fce33a0dc8dedcb57e0130578c5d0d928763e158a37d7b4c78b996c4e555eee4eba2df5a3b05360b1cb342e14f8ca3fee523d81ce2d7a96a866cb13a40ed6bc028e75415248d95417a7a22855fea17844af8dd0aa28b5d1332c43799"}, 0xd4) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r0, 0xf501, 0x0) [ 1724.668479][T20483] loop5: detected capacity change from 0 to 16 [ 1724.698703][T20483] attempt to access beyond end of device [ 1724.698703][T20483] loop5: rw=34817, want=184, limit=16 03:11:15 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3f000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1724.715717][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1724.717689][T20493] attempt to access beyond end of device [ 1724.717689][T20493] loop5: rw=34817, want=184, limit=16 [ 1724.724054][T20480] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:15 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000001b000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1724.770294][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.778333][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1724.795830][T16800] attempt to access beyond end of device [ 1724.795830][T16800] loop5: rw=1, want=256, limit=16 [ 1724.806443][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.814467][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1724.876339][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.884611][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1724.896395][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.904526][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1724.925199][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.933473][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1724.944807][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.952927][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1724.989878][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1724.997913][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1725.011993][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.020025][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1725.032347][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.040315][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1725.051426][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.059414][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1725.071265][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.079266][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000001324bd7d [ 1725.098917][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.106925][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1725.118617][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.126628][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1725.137841][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.146327][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1725.172936][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.181254][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1725.193414][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.201421][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1725.214860][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.216747][T20521] loop5: detected capacity change from 0 to 16 [ 1725.222925][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1725.239891][T20521] attempt to access beyond end of device [ 1725.239891][T20521] loop5: rw=34817, want=184, limit=16 [ 1725.240455][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.259428][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1725.260868][T20525] attempt to access beyond end of device [ 1725.260868][T20525] loop5: rw=34817, want=184, limit=16 [ 1725.270813][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.291436][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1725.302731][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.303609][T19085] attempt to access beyond end of device [ 1725.303609][T19085] loop5: rw=1, want=256, limit=16 [ 1725.310712][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1725.311550][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.340325][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1725.352229][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.360313][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1725.371761][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.379827][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1725.390973][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.399121][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:16 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe03}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:16 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000140000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:16 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x4, 0x4, &(0x7f00000001c0)=[{&(0x7f0000000480)="efb18274eb96271f9362e02dd9fd3b401c82e7ecc434f969545778387740969859be95080fd0cf28269f9725acdec92976f6ab0c61cf5d0b6a23f885e08f13a6dffea3551c5a4c4e6c14a3e3c97dbc43f89f1b8b0213d4f4ba59b637f1205971b51040ea330892c0e74f24eff4df577f4e9489abc9aaea5cb63ee274c062da3a36dbed2c2eb04e8b2a01399fbe83b6b0bc4d86af7eca28408d5afb98546f31873c16002c6e9e4c5f0876f3159c35a4a15c8dbc4bf291c0dfc2ab76f84ebca083ebf704ec0b79164e79a2bc7db87c801ad6141f25ce1a3807fb91c0c707bf7cbe8d0611aacdc57327c8c64b1d084244106d0fdb9bed75858fa068883498719e49f753716043a393bd7da3714c9a3ecb7d533e7ae6dc40adbd229b249eb54b475fa3ce3d4d345fe56480ac3c01d70a03e89be76aa8fbf9e298bb9eb1a5b5a01c8823a4000c75f6d91c95dfe590b81e6c2020df6630f8b0a7b5b5378adbd2326adf861a2895746d151b7692546aca49477f74b9cc19b5a2edb979f2a9a1f1970e8492a6a70e3191b4b5e85ddab8966a13dee175b7600079947778ef3235be0b2b470554ed6a01c45ad06a407ea03b40bbdd61cd19ecb2933cd02c1544ce33332ea7cc92402bb4270b7098293ce5de12612b82a7b312a27bc1c2ca69506ac1c2fe0c19410eaa0069d802dfcd7c16ac994b70842e7e751d84b907e6e6a3c3eb62b6b4148f3d0ded973ec1b1eeec8ca47a111cf9a08704ad4894f65f78e0e88cfe829d40dfd7d14d9884134a6290b8a5956e004e26e8177a8798afe938fad03469f09d056eedf003cc9afc3dc936b84b77ea4919580a8523fbf88152bac260fce5c05cd1a35351c620cf3a18966564d90e7387616d06ecc96dd66a72eecbcbab60e2a13d0ac2dbe984ca135810185680bbc0847a3db308dd8e9c1ed8e1e3ba47aa10f2dc84cad3ba4dc8008b1cd3fbb37b4f23e721e0f07dd6b9142921776fc095b171eea2b84df545542420500439ae8bb37d3c563d0ad59e83c2ae7a9dfd47b84d970770d3e1c2f006ebc403080fed7772bb599ff18d7429aa665cdb66d185dd208787845bed136ae3c27ddafb3ff88f041342d0db2f9fad76016d27e73b4845fefc13fe8c927ec3960d981bf599640d1859b26004a6ec86a07fa50a2997772154fc0760d0b5ddeeaf61753556021279795eade009da65885b3b64c5fdcf2ae9c0e19c8ab84d28b6b97525c3065c9fc863149a4b8a309274ddf1d63d341baf216e16559eba3a4cafd25616aef0a2d6af487e89a8b2bed4cc1c86b10ab6cef79c44e4287b4a28feb6aa32febe719bd8b4ca30d143b5c38361037d3816f8a52e1d5ad63d0fb6555d93f12fa77e8b41b90814262bbabb6eefe2fecd17caf2f6d0bc0f4624e3656e9b8a546c1f893334675a972e0dbed0d45b57687fdbf638c71b18be7810460af251cef915a6db7ba11141ba8255a1710e80503b10d7c2a82f732736d0a582fc9057ab1e0f2baa0cc54eaa7180a4c7112f0d3f866077e985b65b6319329bc00a050fc589804c2221d630c292d82a85d5ee3a97f5964719f84164c82d8deeeaeef772a44a0d295151a24a3b05ba81238f6595bdad19ee06ab935b2266a4f3711dd7c91687285466f5dab01e21bc3c3eb635c2e45ebc8f107f250cc64c4ded7798b68a6fc85a4fe8c30145e1e55d3c32006e24f738fcecc11e6d8199109cd325947ce4539b1c139d7bd1b4a1a4bc4443fc7fc233fd641e724a37a19caa5230ed95a5f2baf657dd2f2072b290408a84d7ec43fd38a92c4d03437bdf774c74b3d8928a212358f49baef2ec436a3ba599f13687c80be323361e4a3b36c3b2a8240eee6653d5745c60dcfb57ba27a47227e38cd12fda6dcd8ac8a8547e9b4279f077a8d31f132b4b6480f9722dce1e73d28c4d7f2fb92be65bb3f3a6b3504a1a5d8673e9581d5973704258f1d068db6f5ec9198ea4e8a6b834108c9ae7483819b80eb60d292ccb4634e39f10a1737b1804f818095e69952d337efe6dfb041a281c0df394237145d4f1e513919e8525f92ef651fe3ee6aa2d1f4cb7eeeb05c282e8f4802925dd6d5ec0f31ebd36e5adaae85d5526f0c245715948b82af222b7fa5bfe7e482e958a13130e1520e6ea1a34fae3ab6a720f40a76194fe170ef6746806cfffebfaa76ba8ebbe9f1c2fa9a81eb7699b16ec25a0900a935420099d4079b54f46931ab93b8aa2c25f03444be9de62e07cde4852a28b2652d2cb13ca6dc8568c51285c83478d56bdfd10af15ca4f38c04c032b879307419c47148bec462eb9dc7f9f4d29cfd2c1d65405e86ed2a0bcce94f439932d31361972cc18063981f25a597039c3f8d16341d5da4459c9dce0c93dc34db08d422fba99fb73bba517d90ffd28cfe7eae24f54542e308edd44aef2fb2d2b19088cedea267759cc1313e31dedc3a389f3d47e71ef022af1c043a6775a16e7d3f65b646c8779e09c89a11c06351e3c78ea9ad84f22684814def4381234402d8c511a24923421e7323807ab939936d93a6a9090259643f8f354b09b073e23e232a458690a2c20b640467b434be57f6a8741b42e856509c1ae5a84bdb1cf08c7181d59fcecf9019fee9d19cbf8856f983ea980bb46c4845c5455f29f42cf4f6105b094919a38dc87fc8a7e28ca4b6e27837c2fb534888b7fc792df1ff06347ab304c05f00c128bc89b16f7afab35e8c9aeef8e0d31702cf3bc7961647f2c894ba790829a0b95547687d3ba54899d5dd778fbf1c2282dc7c9912e77a3278e2ce2facd459542fb087f7aa93acb21db534b858d79cf45dbf6e0353c72ddfdab92ac494228e40b0bd74a620b78525c858442b2192b3e037c29ec5bb48d9a340f9388d1a51e18d6bc1e6d633dfb012ca658b2736043003723d2a60c2c66fefc92d81c846789dd48138149ba763ca51b3163015090654c87c8620564ea2fd99971d642aff99bfce6b0582b79a8b5833bfafd9d522c3068110ddfecba2298fd7762f87fd9e60b14ba5ed37bd1bd5bc19f2ecaf7cdad9b5330b66786301a41e7c4e13793c71386c20a549229bf40472f65847e01e6bbefc7500f56d7b17979d72b8a7d3a6b3916e1dffd83f76185d0edb6a8880c9335e63f971b446940d60b7ba08dc9e56a7f3d8e0a3db8b40fc0e75322c7db56b1cd8f1bea48e476521b6509601514e779b6c3924212f3fd19b62ecc376ee555a41aa569bae55030143fec428f1fd234d0f548e5d8ffefe492728d9c975cdf7a72b4f4736d04ecad4aa8ecedfc5ad171bb004e2d26af7d9fba1f1083ecc035621058e6fbcc4a3d7309fe1cb4ff311836f7abf4d1d400a8fe8e0507350eb7ae4f2c49d1ea1f4ff96c0a6ee1c7b87c288aef6d50c39c32f41224c2cd2b96ad3c33e96a7730aafd56c7cf81586200c310fc9b2517a57f506da7cdab5d8dcd444bbfd57c410c281316418344fdf9fe6e4c961f40b7dbc052af4574cb45715d9b22bce3ebf55ca66459d74c532513bd05098ebc28c6817874a341f3beffd6c60fb44c619935721795bc8046efdfd8b76a720ca2b6bd9b2e75107f8d49ca113e48dec2d708c3f5026e05b0777b1aaef9c0b98ce527b5b0ff0f5bd703ce9475e0edf74b30c2b77113a0c881130a16b52bc43ed948b849376e7684675685730dc850a556ff34d094081d8fb3db2cfd0e2f7e6d7ea4383df107a395a07e825078398374cb4f22eaf84efeed03b31c9f3c45a14080f44b62a8a63dbc5ca9056f0d6d102f9beb326d88e66fd9003f8ac1cabd6fcac09a7347bf442c46113d0c27749464c4608d01729f6de156d192fc85f6fea486fab8707828bc803e90e938c839f3fc0c9ec250a8c9e8a03e6a680dc8bcd4551afca3efffafba79e02b95a815c44188fcd73b587bf637e0fbd35b35a6c3b7fea27c60e85c3fc6aabe7bc08d1f455c366b59c7917e0eab854dc2f80620f69bbc824afcede9a3f3866667354868d05681cc4dc2cc664dcc44789cae0f493503a9d261ca6e51c2aecb54d841fa5e397c071aefa6d7d4348052ecd682bc8fd323dd381f0dc3c612a6fc1ba96a0af9347c14d4129949a2f8d757d4a9df6ac4e0980cb844c09808c2f83ee2807640b93799241cb334e9bed0ad93ea070495f36c673f82ea9c39609337640e94204f0ead8bf2d1db18816e130a819f4f0f59c026a5ac9abc0c82d346a016e0e5d69a3193aeadf3b3448a5a9878b5ed49feca0080b51c87fb0c131344fcddb2622d36385f6a108804661a20aaad1141afaced0b1588528498fc53fefb47a487c87fb9c2730702bd77f8a2f48553dceb41c0be861db3a8cc8a997f6d3f605acbc18e3d777d91be796635f24a90084d5eb2bb5a5b26d6600f8975884ddec16f856c5aade51044b7f633fb00e068576a4b9ac821d316a4ef13bda6647202aa90d279204dcece1b02a00f28d1b9c981acac922484b8f2f436a1ba394ef9a207332fd87773e0a5cd8f57e90778091b62c1bff58a8df5e4fcd8fe646b7e212d4631fa418d77a3bcbd0d96811e6cce68b1c717eac11d5d3e2bf8717513567275b79f211ed260d2faaa1a78eadef67b21448d19930276d77635ee2de7fea73301d53512964f6ed86e90e5b8732e799bfab3d6ddf1edee01f6cf35d12377aeda64d7f3237ebcd4619f794cb212996ff26cdd9d761ac504afc1178dfd76e771cab105926cd57a88f87a1ac0478fdb414956df9fc533cf57fa4bd3abbb1d5635a2050ae878f35bd01f9caed2374be2f07f85bebd42e0a200719d0ee634561b5840a71316e60c27e7662f4c0f48db4f24721d87f753cb7f4143698b9e4c9cfc1175ac4fe713e1da8d550f74c1836386a09bc6e680cfdee7c1a8e34e9ff12258583ab7e7b79901f0e8c772ec17c8a43b3fb2a18033077dfe1c4bc799f52da345e57f7465cc7081f4ba52d953000a0bbfb64e4acd8c48018896406a06635f3883e7b9735f270e90d4bbae719a51a261d1bd78e094c03c162c42db3fad12cf54ad8e0dd35ec16afe41fc9c8ce9a010eaa4e6c1e4e5774332d87cfa074c1408bf956cb69282bd834db5f6985e6e0b40420142094267f2db6ba07b09ae96a1bc54a3ee8545339202f36a07b6655c5baf213876e04f164b9825e066e6a7ef336a349ee0ecc62a4686c2996474789fcc5e2df810dd9384fe58a6cbae041ad8199ae15bbd63d37852b8e209f7bfd4270404818f47a27dfaae9ace3c36b42b70834af8ebd47e5d356cec2a8cccd1ed9b44d3ec2239c0922233516122c4fe6b61ffd56f09ae415c3253ac28cbcceb67c93a055574feae0120115f9406adad4610f4ba445ab958557dfd64bf74683c0ef95e4c66b18c031c341f1d981ecaa0ab4998b60de0f2ebbe118f02ca8ed0ff984d4494edc17bf7be9a76ab2b1c9e3bc8855b162440175b798307951593aa76a521c4ffe7b5108efb209c5185c38d6ccd4d9bf23fe93443df7879892ad978ea99934e15eacd3fe8381c1183f0e26bfe859a2d7f27cf12dab74239ca54f9420560f4a24604a3914cc964a0614bc749258c069d42469fc3c1e225f1d3d32fc3281fda20a87523a41343723e86883903439280e2225ab7314cac6672a1f69f5cd363fea7cf2ce96b593d1b784d8f2bfd6ae0d4cf9bef4562e0d4a80840794888f44b7ba9db25937ccbc953851e2c690e35760516d60266eaabfee834f33a225cbc2108935740e4f67f3fd54ddb4b801d4b8baeea80a4beeb44ead3ce200e81e63c8cc3123df24c92936bf1190d00e6da97998e7ae8d9d340ef5c8a0bf8a0e66f78", 0x1000, 0xffff}, {&(0x7f00000000c0)="05cb081dacd4147d0880fd82cf6f84ed222e2c254172fe071feffdc4fc6214d7a0b490b66db4b897ac", 0x29, 0x16}, {&(0x7f0000000100)="c5ec7ef8e726aa17230d91f7c02f86", 0xf, 0xffffffff}, {&(0x7f0000000140)="db715923ce87e8ed17415fa7949747df4488a80628d5005c744e3871bfc196744c64a9ea46d57431f08ff0699fee2f045ad1978063f7ff97825c8603c29769dc6d0dd5328484a13ae7f3a07509ac32fd94ff22f565d200af0b274da3cc64168b36", 0x61, 0x4f5d}], 0x800000, &(0x7f0000001600)={[{@dots}, {@fat=@errors_remount}, {@dots}, {@dots}, {@fat=@errors_remount}, {@nodots}], [{@obj_type}, {@euid_lt={'euid<', 0xee01}}]}) dup2(r0, r1) r2 = syz_open_dev$sg(&(0x7f00000002c0), 0x2, 0x1c9302) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000300)=""/77, 0x4d}, {&(0x7f0000000380)=""/137, 0x89}, {&(0x7f0000001480)=""/211, 0xd3}, {&(0x7f0000001580)=""/50, 0x32}], 0x4, 0xfffffc00, 0x4e10) 03:11:16 executing program 1: prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000000)) prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000040)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r2, 0x8935, &(0x7f0000000000)) dup2(r1, r2) 03:11:16 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000022000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x40000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1725.497126][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.505300][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1725.516828][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.524998][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1725.536221][T20480] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:16 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000025000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:16 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = signalfd(r0, &(0x7f0000000000)={[0x5]}, 0x8) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x201, 0x0) io_submit(0x0, 0x1, &(0x7f0000000140)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x1, r1, &(0x7f0000000040)="7ac7c49c004d48996b1674", 0xb, 0x1f, 0x0, 0x2, r2}]) [ 1725.544227][T20480] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:16 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000150000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1725.607268][T20538] loop5: detected capacity change from 0 to 16 03:11:16 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000029000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1725.651255][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1725.659678][T20536] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1725.688954][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x48000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:16 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xe, 0x10010, r0, 0x5a58000) [ 1725.697006][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1725.711971][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.720005][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1725.778141][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.786165][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1725.797339][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.805624][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1725.825846][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.833843][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1725.845085][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.853130][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1725.881575][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.889600][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1725.903386][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.911373][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1725.923766][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.931732][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1725.942896][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.950883][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1725.963241][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.971241][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000015ec177b [ 1725.991239][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1725.999262][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1726.010492][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.018527][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1726.029732][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.037721][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1726.063870][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.071957][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1726.086855][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.088567][T20572] loop5: detected capacity change from 0 to 16 [ 1726.094935][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1726.113778][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.121822][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1726.133452][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.141469][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1726.153194][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.161238][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1726.173200][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.181217][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1726.193370][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.201439][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1726.213094][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.221179][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1726.232314][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.240585][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1726.251745][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.259713][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1726.356397][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.364755][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1726.376314][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.384441][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1726.395739][T20536] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.404050][T20536] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:17 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff01}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:17 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000160000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:17 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000000c0)=""/159, 0x9f}, {&(0x7f0000000180)=""/170, 0xaa}, {&(0x7f0000000240)=""/188, 0xbc}, {&(0x7f0000000480)=""/4096, 0x1000}, {&(0x7f0000000300)=""/134, 0x86}, {&(0x7f0000000000)=""/26, 0x1a}, {&(0x7f0000001480)=""/137, 0x89}], 0x7, 0xca3, 0x257) 03:11:17 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000002e000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:17 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="757365722e28b5ce170002008c433986d4738075afb8b546989bddb50e0ca813a9e59d9203b60c93050090f85b6ee16e2cf800a3658232df109b000000000000705e9e79cb"], 0x0, 0x0) r1 = pidfd_getfd(r0, r0, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r1, 0xc0709411, &(0x7f0000000000)={{0x0, 0x8001, 0x2c2, 0x10001, 0x2, 0xef, 0x4, 0xad3, 0x10000, 0x5, 0x6, 0x3, 0x20, 0x100, 0x10001}, 0x10, [0x0, 0x0]}) 03:11:17 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x4c000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1726.450554][T20584] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1726.458823][T20584] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1726.474902][T20584] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.482914][T20584] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:17 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000032000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1726.534051][T20587] validate_nla: 46 callbacks suppressed [ 1726.534070][T20587] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1726.550839][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1726.559161][T20593] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1726.560263][T20595] loop5: detected capacity change from 0 to 16 03:11:17 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = open_tree(r0, &(0x7f0000000000)='./file0\x00', 0x1000) sendmsg$IPCTNL_MSG_EXP_DELETE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000000202050000000000000000000c0000031400038006000340000400000600034000030000949b6dc773697000"], 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) r2 = getegid() lchown(&(0x7f0000000180)='./file1\x00', 0xee00, r2) 03:11:17 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x60000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:17 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='system.advise\x00', 0x0, 0x0) 03:11:17 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000170000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1726.572905][T20587] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1726.595963][T20587] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1726.601077][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.605470][T20603] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1726.612218][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1726.642884][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.650913][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1726.699439][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.707637][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1726.719108][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.727153][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1726.747994][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.756307][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1726.767664][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.775812][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1726.811357][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.819484][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1726.833847][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.841960][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1726.854836][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.862835][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1726.873966][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.881971][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1726.893504][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.902274][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000079427f69 [ 1726.988908][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1726.997430][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000006a6cc15a [ 1727.017055][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.025302][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1727.036562][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.044585][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1727.055745][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.063857][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:17 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) dup2(r0, r0) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) fgetxattr(r1, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) [ 1727.109476][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.119173][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1727.119739][T20618] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1727.139233][T20619] loop5: detected capacity change from 0 to 16 [ 1727.148190][T20618] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1727.158378][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.164892][T20618] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1727.166450][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1727.182263][T20624] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1727.186899][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.201629][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1727.202091][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.220861][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1727.221351][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.221365][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1727.221524][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.221534][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1727.222188][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.222200][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1727.222352][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.222417][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1727.222489][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.222500][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1727.222590][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.222601][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1727.231222][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.358700][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1727.370425][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.378615][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1727.389848][T20593] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.398146][T20593] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:18 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff07}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:18 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000003e000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000001e0000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:18 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE(r0, 0x5000940c, 0x0) 03:11:18 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x68000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:18 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r1, 0x200, 0x70bd27, 0x8, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x9}]}, 0x30}, 0x1, 0x0, 0x0, 0x811}, 0x4000840) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x4e) [ 1727.443929][T20630] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1727.452236][T20630] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:18 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000048000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000200000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1727.524825][T20648] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1727.536611][T20648] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1727.545602][T20649] loop5: detected capacity change from 0 to 16 [ 1727.559541][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1727.567867][T20650] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:18 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) fgetxattr(r1, &(0x7f00000001c0)=@random={'system.', '%.(#$%!\x00'}, &(0x7f0000000200)=""/170, 0xaa) r2 = socket$inet6_udp(0xa, 0x2, 0x0) fgetxattr(r2, &(0x7f0000000040)=@known='trusted.overlay.nlink\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = pidfd_open(0xffffffffffffffff, 0x0) dup2(r4, r5) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r6, 0x8935, &(0x7f0000000000)) dup2(r3, r6) fgetxattr(r0, &(0x7f0000000080)=@known='trusted.overlay.metacopy\x00', &(0x7f00000000c0)=""/237, 0xed) pipe2(&(0x7f00000002c0)={0xffffffffffffffff}, 0x84800) ioctl$NS_GET_USERNS(r7, 0xb701, 0x0) 03:11:18 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x6c000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:18 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000000)=@random={'os2.', 'security.selinux\x00'}, 0x0, 0x0) preadv(r0, &(0x7f0000000300)=[{&(0x7f0000000040)=""/224, 0xe0}, {&(0x7f0000000140)=""/50, 0x32}, {&(0x7f0000000180)=""/193, 0xc1}, {&(0x7f0000000280)}, {&(0x7f00000002c0)=""/4, 0x4}], 0x5, 0x3f, 0x8) 03:11:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000210000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1727.596314][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.604350][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1727.644402][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.652944][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1727.700192][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.708336][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1727.719848][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.727943][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1727.748250][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.756445][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1727.767645][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.775662][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1727.811600][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.819916][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1727.834950][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.843034][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1727.855615][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.863624][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1727.874846][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.882829][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1727.894778][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1727.902971][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ea8917f3 [ 1727.998715][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.006922][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ea1d7aac [ 1728.026797][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.034812][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1728.046271][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.054409][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1728.066117][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.074157][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1728.097138][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.105193][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1728.117094][T20676] loop5: detected capacity change from 0 to 16 [ 1728.117214][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.131320][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1728.146806][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.154859][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1728.166325][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.174353][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1728.174809][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.174819][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1728.174866][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.174877][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1728.175594][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.175606][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1728.175765][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.175775][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1728.175855][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.175932][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1728.176000][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.176009][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1728.176205][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.176213][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1728.176249][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.176260][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 03:11:19 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000250000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:19 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000004c000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:19 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x74000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:19 executing program 2: r0 = gettid() ptrace$getregset(0x4204, r0, 0x202, &(0x7f0000000000)={&(0x7f0000000480)=""/4096, 0x1000}) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r1, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:19 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffef}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:19 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) readv(r1, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/69, 0x45}], 0x1) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) [ 1728.176321][T20650] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.176332][T20650] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1728.247261][T20689] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1728.379620][T20689] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:19 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid_for_children\x00') fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:19 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000020000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:19 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000059000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:19 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000000)=ANY=[], 0x0, 0x0) [ 1728.455242][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1728.463648][T20708] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1728.476245][T20711] loop5: detected capacity change from 0 to 16 03:11:19 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r0, 0x8008f511, &(0x7f0000000080)) r2 = syz_open_dev$vcsn(&(0x7f0000000040), 0x7, 0x428401) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x810, r2, 0x0) fgetxattr(r1, &(0x7f00000000c0)=@random={'trusted.', '#!\x001\"\x9d\xd8*g\"V> \xd6\xf6\xbeb\xfa\x8bn?3`p\xfeA\xee$\x97,V\xb9\xe2SYM\xec\x8b\xae\"q\xb8\xff }yY\xd6\xd0\x15T\x02cz\xef\xd7FA\x92\x8d\xc0\xc1n\xb4\xae\x8b\xbfu\xfa9\xa9\xd2\x88\x1e\n\x8f\xf5\x80y\x84\xed$\xb3\xb8vd@cV!\f_\xb8\x1b\xaf`\xa4\xd5gh\xf9\xf5\xf6\x83-J\x17 \r\xfcf\xacP\xc4\xdcg\xf4L\xdd\x8c\xf4\xd2\x1fX[Yn\xedP\xfcN\xb8O\xdc\xce\x96\xb9\xb2q\x95\xd7\x82&^\xbe\xc8\x86\x02y!\xacLY\x13\xc3\xb9\xb3\x116Z\xb9\xb5\x7fU\xd8A5\xc1>\x8eF\xde\x8f\xbcs]\xf2\x8e<,0\xe8\x7f}\x89\xa5s\x19Z\xf9\x1a\xf0W;\v\x14\x00\x97;(\x14!\xdeq\xbc\xb4\xe9\x8a\xee5\xd7\x14\xbb\xd7OCu\xedQ\xbd\xb4\xc5\x87\x89\x80\xd4K\x88\x9aW5\x94\xeb\xa0\xeb\xf7Y\xcf\xc5W\x8f\x9d\xa6W\x8f'}, 0x0, 0x0) 03:11:19 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x7a000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1728.503534][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.511593][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1728.540651][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.548696][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1728.596962][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.605169][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1728.616651][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.624810][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1728.645716][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.654040][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1728.665659][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.673684][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1728.698134][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.707001][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000666d0185 [ 1728.729885][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.737895][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1728.751865][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.759934][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1728.772466][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.780446][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1728.791677][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.799643][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1728.811247][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.819222][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000000ff2283b [ 1728.909857][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.917918][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1728.929378][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.937607][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1728.948824][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1728.956932][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:19 executing program 2: ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(0xffffffffffffffff, 0x4008941a, &(0x7f0000000000)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x23201, 0x0) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$P9_RLOPEN(r1, &(0x7f0000000100)={0x18, 0xd, 0x1, {{0x20, 0x2, 0x8}}}, 0x18) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:19 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000005a000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:19 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000030000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:19 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x6140, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r1, 0x8935, &(0x7f0000000000)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) syz_open_dev$char_raw(&(0x7f0000000100), 0x1, 0x103000) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000140)={'veth1_to_hsr\x00'}) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r3, 0x8935, &(0x7f0000000000)) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000040)={0x30000010}) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) [ 1729.004575][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.012760][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1729.023152][T20736] loop5: detected capacity change from 0 to 16 [ 1729.042306][T20736] handle_bad_sector: 20 callbacks suppressed [ 1729.042320][T20736] attempt to access beyond end of device [ 1729.042320][T20736] loop5: rw=34817, want=184, limit=16 [ 1729.064881][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.072953][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1729.077799][T20745] attempt to access beyond end of device [ 1729.077799][T20745] loop5: rw=34817, want=184, limit=16 [ 1729.085635][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.103254][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1729.114468][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.115233][T16800] attempt to access beyond end of device [ 1729.115233][T16800] loop5: rw=1, want=256, limit=16 [ 1729.122470][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1729.144393][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.152398][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1729.163582][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.171589][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1729.191199][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.199209][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1729.211034][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.219035][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1729.230503][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.238645][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1729.249918][T20708] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.257967][T20708] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:20 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:20 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xb0000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:20 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000040000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:20 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000005b000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:20 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000040)=@known='security.selinux\x00', 0x0, 0x0) 03:11:20 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) write$9p(r0, &(0x7f0000000000)="4b628a67ce4384bd3ee4563ae4079814028cc636da04ac8b6d527e46df19b467d1f23a063680c5b0606ea78af22c96d820cda4237745a10aabeeade3cf6a5976bcea7342cbd1371d1232991b2239815c1fe1e6fd", 0x54) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) flock(r2, 0x18) fgetxattr(r1, &(0x7f00000000c0)=@known='security.apparmor\x00', 0x0, 0x0) 03:11:20 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000050000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:20 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000005c000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1729.469290][T20773] loop5: detected capacity change from 0 to 16 [ 1729.507100][T20773] attempt to access beyond end of device [ 1729.507100][T20773] loop5: rw=34817, want=184, limit=16 03:11:20 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r0, 0xc0709411, &(0x7f00000000c0)={{0x0, 0x0, 0x3f, 0x6f616a1c, 0xf89, 0x7422f974, 0xfff, 0x8, 0x8, 0x9, 0x80000000, 0x100000001, 0x9, 0xffff, 0x3}, 0x8, [0x0]}) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000140)) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r0, 0xc0709411, &(0x7f0000000000)={{r1, 0x8001, 0x31, 0x9, 0x800000001, 0xffffffffe4b11f35, 0x1, 0x1d, 0x5, 0x433, 0x7, 0x7d, 0x2950beb4, 0x5, 0x9}}) 03:11:20 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x10, r1, 0xef7eb000) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) [ 1729.525048][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1729.533359][T20778] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1729.551196][T20791] attempt to access beyond end of device [ 1729.551196][T20791] loop5: rw=34817, want=184, limit=16 03:11:20 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000005d000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:20 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000060000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1729.576593][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.584631][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1729.609603][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.617654][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1729.648086][T16800] attempt to access beyond end of device [ 1729.648086][T16800] loop5: rw=1, want=256, limit=16 [ 1729.668872][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.676906][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1729.688700][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.696813][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1729.717846][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.725993][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1729.737376][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.745481][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1729.774931][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.783065][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1729.796962][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.804993][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1729.817335][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.825364][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1729.836524][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.844511][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1729.856363][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.864389][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000001324bd7d [ 1729.884501][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.892504][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1729.903620][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.911626][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1729.922739][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.930783][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1729.967378][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1729.975416][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1730.001508][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.009529][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1730.011492][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.028842][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1730.029031][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.047934][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1730.059332][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.067324][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1730.078581][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.086567][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1730.105747][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.113902][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1730.125212][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.133208][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1730.145000][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.152996][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1730.164251][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.172233][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1730.190669][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.198693][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1730.209964][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.217987][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1730.229107][T20778] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.237136][T20778] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000070000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:21 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe09f7b07, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:21 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:21 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000060000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:21 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000000)=@random={'trusted.', '!.}\x00'}, 0x0, 0x16) 03:11:21 executing program 2: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x5, 0x2, &(0x7f0000000240)=[{&(0x7f00000000c0)="3af0842b53a1073cd9329593b381bb8015cd7cc9c5e398242b19357c5183bb589a47d1eafe58842ee80f3ec7a2bc4ecff6b7e9f5bb1ece7c5a2d65e35aa41277602f967df42fae66653f6a1536b5214a9b5d0ba6c9dfa6b73f4b1028c3c89899d06347f5abb0fccda51d212932241b9a46ef82e7848b8e6cca3844b351e2f392c7ce277946869612680e7fa7e7c30d0aa0f9f1d96148ceb70155055cf6c6ec183d86808817ffb330187d603cd493a2a12d8bc9c930e40291353c97da96b66bcea42eae36a9239cb8514627563008a02f3353c8394d23b579807717d79ad33e3637b8b9", 0xe3, 0xfffffffffffffff7}, {&(0x7f00000001c0)="a805c089fabb358e1ee560bd335e84ba9d101f93d4fb36c03563e6b45d03a46ea71e2855dd3df84ed43bf401ef91a5e003bf19ff24260f842d04ed0dc5c10eb4d5158dd259cc536862519bb3ed450065a354c9f0", 0x54, 0xffffffff}], 0x1000000, &(0x7f0000000280)={[{@utf8}, {@fat=@fmask={'fmask', 0x3d, 0x9}}], [{@fsuuid={'fsuuid', 0x3d, {[0x30, 0x6c, 0x62, 0x32, 0x54, 0x31, 0x36, 0x38], 0x2d, [0x35, 0x63, 0x35, 0x31], 0x2d, [0x36, 0x35, 0x33, 0x38], 0x2d, [0xc8f61a80d5067e73, 0x6, 0x30, 0x31], 0x2d, [0x7741432342622e20, 0x38, 0x0, 0x30, 0x37, 0x39, 0x66, 0x35]}}}, {@obj_type={'obj_type', 0x3d, 'trusted.overlay.upper\x00'}}]}) r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) fgetxattr(r0, &(0x7f0000000000)=@random={'user.', 'trust\v\x17-\x83zZ[\x1day.upper\x00'}, 0x0, 0x52) 03:11:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000080000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:21 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000068000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1730.276936][T20823] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1730.285243][T20823] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1730.300478][T20823] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.308481][T20823] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:21 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000040)=@random={'user.', '/dev/vcsa\x00'}, 0x0, 0x0) 03:11:21 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) sendmsg(r2, &(0x7f0000000780)={&(0x7f0000000000)=@hci={0x1f, 0x2, 0x3}, 0x80, &(0x7f0000000580)=[{&(0x7f00000001c0)="35b8ad9fb47db8651e5398939796b73a588b051af76f5d1bf171f123ec05259d2db721a4c5c600ed72b45fb22aba4a700ec7ffeee3cd0b54ca47a433df573f4a5fff3bf8bd9a36e46b16df5e39601f065e2cb119c0eda0bbc0a8aa817a0a6a1f12340c0ed257bd7ae0f5a5307b44b8fac3a213785218841d12c33a30500009086e822a9f6eadf379d3e9952d9ae3d54214b72c74834a34e03de05c41c6df048e49083a28ddc351a7ad53be48d0df6384adfd765715d6d50bc4eb72e8f70951c16184ab6dc28cd6b686100bed57a67af61c644032b6ceca4d6a663e699d7058fe9fb6f1d3a557c894a9dc5341d7ffa4a227552fb853862651", 0xf8}, {&(0x7f00000002c0)="7dbfd5fcef60c77c74c32f3756884526a0509fad2c6c8ae064ff89ffb36e9c380287c8d4d4830ef17d50346d237705de6e3cd7ed555ee7ca73e155508486d69665216fe45cde5da869cd0d41a8b88b375ec00ddbc2a492c5ea83a179a16ed5ee458bb4a224776843334274b70826a17fe1f290ed9e1a1c9cd0efac7941a95ffb491a21c1c522f69053489d7f960b84a8b205a97a60368d8aafc6b68830edc8573a061ecc84dcfc6f4df0cea0cb4e8aca9699cbce49ae9b83f373080f", 0xbc}, {&(0x7f0000000480)="d6a92132c039563a4f8c7e9023df621908fb83111eff2fcb3d2aec0a3b5a62f45e7a019be851fd3ac1bc77d2342d5ceb692e267c7a320caefa701b5adb7a1a68a129273d43d4a5e2493afd3612a4e25b3b7adaa34cc7c3d3ffcb6623319bff6a6571b40dedc4ec29236b05f0a4c561e45d292522ad5da993e8c5669b96510c5cd1b9ab54513cd55aab024b5628e1de0618f69c37fa3518c5aea94093c45d4dcf9fad565d05107b52327a683c0797f5066886db42eefaaf7c833aa3a090a97918c46be7182e1a56", 0xc7}, {&(0x7f0000000380)="96f099ebf6091125036491cf8d21e4732154f24adeb0b7880944f4da607286474afc9af447cc26919a26252ab18e162f3b908a6073f80b44a003ebe17ebbaa554a3183f0ea69f752edda2c84db6ab2a1a402ad35a29d4a59fb8c198d81596babd7", 0x61}, {&(0x7f0000000400)="44f721f85ed7defc092aae4407ab", 0xe}], 0x5, &(0x7f0000000600)=[{0x18, 0x117, 0x1400000, "88"}, {0x70, 0x111, 0xff, "11d342d790544432832c64ad4c6e41c2583cd9b7ac0a58bd182f0309292c5bd939d03e0f2ca04dfb997e214c149a678d1c2f303f2d609ea9b94ff779910412fe8971a7c5789a83d8cb98265afd943971d978e94da27370ef4d0389729a5cb6"}, {0x28, 0x4, 0x0, "c307ae57870143d46d8c0220b0a2b7e674"}, {0x38, 0x103, 0x800, "5c09e9c39e09c93611b2453d4a9d93f4c158a3f398b102f3dafed58ea106fd1a8b9a02c372"}, {0x90, 0x119, 0x6, "6bbdfb3e2499b9ba4b504f0276ed501a0b093162601071d69c3128172a5bbaf978789f13a87601fcd74fc6fcdd74ba60be3a4bdf4361c550a482d2a4c9c4182a22a8b8ef34b2a5f19950c744a22b937989992dcc93963cab0a855a5801800143eae9d3ac6efd9afa96ce747814b02dfb0e0a82e7f8aa4aa8cf8ac5"}], 0x178}, 0x0) ioctl$sock_netdev_private(r1, 0x8935, &(0x7f0000000000)) pwrite64(r1, &(0x7f00000000c0)="a83323d305507728ba4cd994bbb9581000118b966c08427562a13879033d28a0453450f310f609aef4d6449cdc0287b7ea4d8e4909a1777abce86bf1701d2662a0dd09dcacc80c3f8587e80406dae1b4608d2144f2b1a6f3dde108a8268f626e2c871f1252d9a67c937880a971b7b6d5c1ad542a8227678adddd741561e22c2b589fc547cd43d657bbf4235d7fb768ac3f5af51dab50c05b0a18487434ba9e5c116b688540d306c9945f2cdc93506475d6040d611dc7660bf6a2faaeace09c8a212ef32d2921dea23e050aae44c20a385fee3b38ad4395f0b6f2eae59210f5ef", 0xe0, 0x7fff) [ 1730.373415][T20832] loop5: detected capacity change from 0 to 16 [ 1730.400841][T20832] attempt to access beyond end of device [ 1730.400841][T20832] loop5: rw=34817, want=184, limit=16 03:11:21 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000006c000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000a0000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:21 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = syz_open_dev$char_raw(&(0x7f0000000200), 0x0, 0x101000) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) write$binfmt_script(r1, &(0x7f0000000240)={'#! ', './file0', [{}, {0x20, 'security.selinux\x00'}, {0x20, 'security.selinux\x00'}], 0xa, "066c51e370de809947a5175fc87f783470cd5da178fed238773e849ac395d57a0e14e95251eacad559482a32edeca1618465e0dec22001056fd8f7657de4804afc26b9007fb239f460468ee861294c2e0cabb3747d6eb270594ea8b7b92a988f96aad3b512196f78c3dd0b6fb64bee16eabce605"}, 0xa4) [ 1730.418096][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1730.421790][T20842] attempt to access beyond end of device [ 1730.421790][T20842] loop5: rw=34817, want=184, limit=16 [ 1730.426645][T20836] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:21 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xeffdffff, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1730.475717][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.485855][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1730.510598][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.518783][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1730.539598][T19085] attempt to access beyond end of device [ 1730.539598][T19085] loop5: rw=1, want=256, limit=16 [ 1730.577172][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.585693][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1730.596979][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.605191][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1730.626030][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.634575][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1730.646454][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.654461][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1730.679902][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.687928][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000a899edd9 [ 1730.709462][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.717496][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1730.731639][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.739638][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1730.752114][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.760312][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1730.771499][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.779621][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1730.791668][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.799911][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000006a6cc15a [ 1730.819936][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.827948][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1730.839083][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.847176][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1730.858927][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.867354][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1730.896250][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.904320][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1730.930061][T20868] loop5: detected capacity change from 0 to 16 [ 1730.948407][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.956462][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1730.960961][T20868] attempt to access beyond end of device [ 1730.960961][T20868] loop5: rw=34817, want=184, limit=16 [ 1730.968752][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1730.986394][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1730.998251][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.006261][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1731.018143][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.026159][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1731.037366][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.045386][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1731.058281][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.066380][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1731.077689][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.085708][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1731.096933][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.104918][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1731.116187][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.124485][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:22 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:22 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) pipe2(&(0x7f0000000000), 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r1 = syz_mount_image$vfat(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x7, 0x1, &(0x7f0000000140)=[{&(0x7f0000000100)="515a91572e13fb0ec005f166616f0662d06380113256941042e7ad23fbf8e0c75226da830b6a8f1ed935dadecc", 0x2d, 0x1}], 0x2002c62, &(0x7f0000000180)={[{@shortname_mixed}], [{@smackfsfloor={'smackfsfloor', 0x3d, '^-'}}, {@permit_directio}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsdef}]}) dup2(0xffffffffffffffff, r1) 03:11:22 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x11f002, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = socket(0x11, 0x800000003, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000380), 0x4800, 0x0) write(r2, &(0x7f00000003c0)="330038637c0bc030853d33b34fa9871846cea1716a6b7681c015cffc1e7e1123bf22faa1aa0bd1aa1eb25d54ad0e9ae1ae401b67eb", 0x35) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) bind$packet(r1, &(0x7f0000000000)={0x11, 0x0, r3}, 0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000000)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x43, r3}) splice(r2, &(0x7f00000000c0)=0x3f, r0, &(0x7f0000000100)=0x2, 0x8, 0x9) 03:11:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000b0000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:22 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000074000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:22 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xefffffff, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:22 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000008, 0x10010, r1, 0x665b6000) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0xd, 0x4) [ 1731.224952][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.233295][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1731.244743][T20836] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.252854][T20836] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 03:11:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000c0000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:22 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000007a000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:22 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f0000000040)={0x3, 0xe, "90dea0d0a42d35678ec119220b9d"}) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="73656375726974792e7309ea4ea083ddc34dbb9d6a544e3cf24b545e2facede435700d4fa2da34cd03e33136fe892bf22ff07e5ee00a5327c7dd9f83d9ea74d3e53eefe981782359429350a9ecf7b9953950e376bc3b4b6951c8a19683907873a6de65e6988adfc6ac3f6fbfb8dc6ec2c0f310c5fd530043f2a2f798008c61b85a"], 0x0, 0xffffffffffffffee) 03:11:22 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xf2ffffff, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1731.334993][T20891] loop5: detected capacity change from 0 to 16 [ 1731.445067][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1731.453685][T20890] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000f0000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1731.489691][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.497741][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1731.525318][T20915] loop5: detected capacity change from 0 to 16 [ 1731.559389][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.567877][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1731.612146][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.620237][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1731.631824][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.639945][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1731.660237][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.668261][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1731.679544][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.687623][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1731.722951][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.731130][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1731.744894][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.753428][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1731.765725][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.773719][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1731.784865][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.792854][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1731.804325][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.812321][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000666d0185 [ 1731.907738][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.916243][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000001324bd7d [ 1731.936186][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.944281][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1731.955654][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.963669][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1731.974948][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1731.983030][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1732.011855][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.019884][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1732.020332][T20931] validate_nla: 54 callbacks suppressed [ 1732.020342][T20931] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1732.035126][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.041387][T20931] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1732.044628][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1732.054031][T20931] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1732.069131][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.074708][T20932] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1732.080090][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1732.107548][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.115589][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1732.126935][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.134985][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1732.146257][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:22 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x104000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:22 executing program 2: creat(&(0x7f0000000000)='./file0\x00', 0x41) r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x9, 0x2000) ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000040)=""/29) r1 = perf_event_open(&(0x7f0000000180)={0x4, 0x80, 0x8, 0x1, 0x7, 0x8, 0x0, 0x8c, 0x20000, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_config_ext={0x4, 0x8}, 0x600, 0x94, 0x3, 0x4, 0x7fff, 0x240, 0x8, 0x0, 0x4, 0x0, 0x438f}, 0xffffffffffffffff, 0x10, 0xffffffffffffffff, 0x9) close(r1) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x80000) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) io_submit(0x0, 0x1, &(0x7f0000000240)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x6, 0x16a2, r2, &(0x7f0000000140)="aeca684cd7c2e8e0bd", 0x9, 0x61, 0x0, 0x2, r3}]) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r0, 0x8010671f, &(0x7f0000000340)={&(0x7f0000000280)=""/192, 0xc0}) fgetxattr(r4, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:22 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000ad000000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:22 executing program 1: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r1, 0x8935, &(0x7f0000000000)) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000000c0)={0x3, &(0x7f0000000080)=[{0x7, 0x9, 0x8, 0x7fff}, {0x8a, 0x5, 0x55, 0x6}, {0xce9, 0x81, 0x8, 0x9}]}, 0x10) fgetxattr(r0, &(0x7f0000000040)=@known='security.apparmor\x00', 0x0, 0x0) 03:11:22 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xf4ffffff, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000100000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1732.154267][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1732.166323][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.174442][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1732.185717][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.194219][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1732.206010][T20890] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.214106][T20890] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe 03:11:23 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000008c010000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:23 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x90040, 0x0) dup2(r1, 0xffffffffffffffff) fgetxattr(r1, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:23 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xf7000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:23 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000120000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1732.275315][T20940] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1732.277815][T20942] loop5: detected capacity change from 0 to 16 [ 1732.289497][T20940] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1732.311940][T20940] netlink: 'syz-executor.0': attribute type 4 has an invalid length. 03:11:23 executing program 1: setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000140)=0x1, 0x4) r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f0000000380)="260000002200470508d258002b1f00eb0101c7033500b000"/38, 0x26) setsockopt$sock_int(r0, 0x1, 0x20800000000008, &(0x7f0000000280), 0x4) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_KEY(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="20000020e3f16191cde75a3606553a0e04e731dc07cfb575cf3db2aedd922014917b7c894225e36a591fa8ba8a33474f69ef9982d87773e3d9309f5896e24bae181887febd591e2ba872c7fcccf231db8b38755d6ebd8629723d6d44e2f7e6a49e7cd19d2854e78e7f9716217a63ad45cb48b3dc4531", @ANYRES16=r1, @ANYBLOB="020000000000000000000a0000000c0099000000000000000000"], 0x20}}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) sendmsg$NL80211_CMD_GET_SURVEY(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @void}}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x4) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r3, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) [ 1732.323841][T20954] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1732.417738][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1732.426352][T20947] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:23 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000008d010000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1732.476700][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.478801][T20973] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1732.484814][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1732.493781][T20973] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1732.518412][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.526453][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1732.537662][T20974] loop5: detected capacity change from 0 to 16 [ 1732.569230][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.577341][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1732.588647][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.596785][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1732.617368][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.625407][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1732.636827][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.644949][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1732.669455][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.677460][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000012cf8bc [ 1732.700337][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.708360][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1732.723034][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.731054][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1732.743656][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.751674][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1732.762829][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.771406][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1732.783177][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.791166][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000056628fd4 [ 1732.887453][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.895870][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ce98e5d3 [ 1732.916477][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.924698][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1732.936722][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.944768][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1732.956140][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.964238][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1732.991196][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1732.999282][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1733.013021][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.021076][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1733.033327][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.041336][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1733.052750][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.060787][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1733.072139][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.080125][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1733.091244][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.099339][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1733.111167][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.119327][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1733.130900][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:23 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x105400}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:23 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x1) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r0, 0x8040942d, &(0x7f0000000000)) 03:11:23 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000130000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:23 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) 03:11:23 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xf8000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:23 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000d2010000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1733.138976][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1733.150211][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.158651][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1733.170170][T20947] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.178145][T20947] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:23 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0xc040, 0x0) fgetxattr(r0, &(0x7f0000000000)=@random={'os2.', 'security.selinux\x00'}, 0x0, 0x0) 03:11:24 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000140000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:24 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000d3010000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:24 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xfbffffff, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:24 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x2010, r0, 0x3d76000) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:24 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x44041, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) [ 1733.255256][T21011] loop5: detected capacity change from 0 to 16 [ 1733.374748][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1733.383242][T21019] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1733.433482][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.434778][T21040] loop5: detected capacity change from 0 to 16 [ 1733.441689][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1733.492342][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.500734][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1733.546825][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.555083][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1733.566616][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.574947][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1733.595323][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.603495][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1733.614929][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.623080][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1733.659108][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.667123][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1733.681195][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.689323][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1733.701883][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.709862][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1733.721070][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.729205][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1733.740758][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.748770][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000079427f69 [ 1733.837121][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.845270][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000000ff2283b [ 1733.865157][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.873196][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1733.885084][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.893222][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1733.904947][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.912951][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1733.940212][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.948838][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1733.960586][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.968566][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1733.981094][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1733.989175][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1734.000480][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.008497][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1734.020587][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.028822][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1734.040199][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.048303][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1734.060212][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.068222][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1734.079543][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.087574][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1734.098898][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.107006][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1734.118350][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.126593][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:24 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b3ae8}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:24 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000150000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:24 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000d6010000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:24 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0x3f) 03:11:24 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c71c0, 0x0) stat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x1000020, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB=',access=client,fscache,dfltgid=', @ANYRESHEX=r2, @ANYBLOB="2c616e616d653d73656375726974792e73656c696e7578002c6163636573733d757365722c63616368653d6d6f6f737f2c716f6e746578743d73686166665f5d2c080268e63d4d94d95f455845432c6d61736b3d4d41595f455845432c646f6e74ffffff7f00a3d5530000002c00"]) r3 = syz_io_uring_setup(0x6b6, &(0x7f00000001c0)={0x0, 0x66b4, 0x10, 0x1, 0x15a, 0x0, r0}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000240), &(0x7f0000000280)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000006, 0x4000010, r3, 0x8748000) 03:11:24 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xff5f0100, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:24 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000e6010000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:24 executing program 2: r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r0, &(0x7f00000018c0)=[{&(0x7f0000001780)=""/195, 0xc3}, {&(0x7f0000001880)=""/3, 0x3}], 0x2, 0x40, 0x2) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000240)={0x0, 0x1, 0xfffffffffffffffa}) openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) fchmodat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x24) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100), 0x80801, 0x0) writev(r1, &(0x7f0000000280)=[{&(0x7f0000000140)="d2edfdf7b1231fc89807e99228c2b2c987c590f2d97d0685f934a3d4061153af3bd9a7fbb425082d80eaa2d67cf85d56f9b9d16dcd"}, {&(0x7f0000000180)="5f16d6a3cdacefffd910cff5f543db28e2dbe943da0f92eb4d32edabbe01b464ae02fa292a97"}, {&(0x7f00000001c0)="a069a0a915e947c11208136df51ee8056c50c758a54e435908676c600892f0857dd432e9e10cafe44a03ff0307cf703b07ef58c8515621bddc2a5db5d0c25d0d5d7ab025807aa5c2ea"}], 0x10000000000000ee) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) getsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000001700), &(0x7f0000001740)=0x8) fgetxattr(r2, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f00000000c0)={'bond0\x00'}) [ 1734.137787][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.145778][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1734.156889][T21019] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.164893][T21019] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 03:11:24 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000160000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:24 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x42042, 0x0) fgetxattr(r0, &(0x7f0000000040)=@random={'system.', '/dev/vcsa\x00'}, 0x0, 0x0) [ 1734.222297][T21066] loop5: detected capacity change from 0 to 16 [ 1734.251751][T21066] handle_bad_sector: 20 callbacks suppressed [ 1734.251763][T21066] attempt to access beyond end of device [ 1734.251763][T21066] loop5: rw=34817, want=184, limit=16 [ 1734.277435][T21079] attempt to access beyond end of device [ 1734.277435][T21079] loop5: rw=34817, want=184, limit=16 [ 1734.296564][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1734.305099][T21069] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:25 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000e9010000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:25 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xff600000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1734.337468][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.345643][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1734.367019][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.375210][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1734.387464][T19085] attempt to access beyond end of device [ 1734.387464][T19085] loop5: rw=1, want=256, limit=16 [ 1734.432090][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.440102][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1734.451660][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.459809][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1734.480215][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.488291][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1734.499669][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.507878][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1734.544367][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.552380][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1734.565990][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.574091][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1734.586680][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.594664][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1734.606063][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.614047][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1734.625917][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.633915][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000079427f69 [ 1734.653948][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.662098][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1734.673351][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.681365][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1734.692954][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.700968][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1734.726460][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.734511][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1734.746724][T21100] loop5: detected capacity change from 0 to 16 [ 1734.763150][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.768460][T21100] attempt to access beyond end of device [ 1734.768460][T21100] loop5: rw=34817, want=184, limit=16 [ 1734.771473][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1734.795283][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.798682][T21106] attempt to access beyond end of device [ 1734.798682][T21106] loop5: rw=34817, want=184, limit=16 [ 1734.803430][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1734.826541][T19085] attempt to access beyond end of device [ 1734.826541][T19085] loop5: rw=1, want=256, limit=16 [ 1734.826596][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.845050][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1734.856586][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.864602][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1734.875730][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.883731][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1734.895478][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.903547][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1734.914815][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.922798][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1734.933978][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.941964][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1734.953072][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1734.961135][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:25 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:25 executing program 1: ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) 03:11:25 executing program 2: setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000000)=@hopopts={0x32, 0x38, '\x00', [@enc_lim={0x4, 0x1, 0x3f}, @ra={0x5, 0x2, 0x3}, @generic={0x40, 0xc9, "1868cbb43dfc1665d8f8c255af985f6f9a88d678329c477f11b1ebe85350206c42e7d7592a39a03ac2700da21afedd93192357bcd230e25a453622cda7bd9ceaefd0c0695df9c9b69de74e01b484778d8a2147691ae6acf037a184071d19028d91e9ac2e7138d6a97ec3d83eabac5c0d4961590375b04087581c6ff4d4e49c562d10d95b2bee9fb35dcb9887ba7bbd247203c3f526bea2ef4a9a8aaf18bf94d230aeaa2c863bcb5140f295390612f84dc5c3392ffc5b5a55018d412129417fc42f76a1106a403be36e"}, @enc_lim={0x4, 0x1, 0x1}, @generic={0x7, 0xdb, "01d6e7444a05c7729f16b3c936f7949bab387c5491efbb484caca310b87ed6fa57a9f5a53682f9ff606062517e0ad67d59bac729c77ed6942d17b4f8a987079c77b3832b02f98c01613b9f432ce0f34104ee2b36ee0407f8195f1139ffbb1479a5d77e01aa7fc1e8673f09fa13208d4b9bfd6c00f51067ba9d45221fc2bebd610f1de87f35043794dc472a5711e7d75cf364b27531d527db242a563dcdc35429265edfd6feae7a1528a5b964431b2a7043c883aeb7324597a2908b560621a95020317bdc3fa781cb958a5010c036b0a0e4bf5754f89d85d84356c0"}, @hao={0xc9, 0x10, @dev={0xfe, 0x80, '\x00', 0xe}}]}, 0x1d0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) 03:11:25 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000170000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:25 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000f8010000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:25 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xffefffff, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1735.064958][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.073024][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1735.084487][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.092706][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1735.103984][T21069] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:25 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000001e0000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:25 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) fgetxattr(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="73656375726974792e252a5e00dd42a848bb5c0ec977d9039d6ab7717e5953f4fad4c5e946e73328c66216d2b080095d183b3e2b750c13"], 0x0, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f00000000c0)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) [ 1735.112078][T21069] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:25 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000f9010000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:25 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x400800, 0x0) fgetxattr(r0, &(0x7f0000000080)=@random={'osx.', 'e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00c\x86\xee\x01\x0f\xc7\xdfI\xfdK}'}, 0x0, 0x0) 03:11:25 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xffffefff, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1735.171979][T21118] loop5: detected capacity change from 0 to 16 [ 1735.206811][T21118] attempt to access beyond end of device [ 1735.206811][T21118] loop5: rw=34817, want=184, limit=16 [ 1735.234162][T21132] attempt to access beyond end of device [ 1735.234162][T21132] loop5: rw=34817, want=184, limit=16 [ 1735.248423][T16800] attempt to access beyond end of device [ 1735.248423][T16800] loop5: rw=1, want=256, limit=16 03:11:26 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000210000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1735.317453][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1735.326337][T21123] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1735.372601][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.381102][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1735.419260][T21151] loop5: detected capacity change from 0 to 16 [ 1735.419964][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.433732][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1735.435633][T21151] attempt to access beyond end of device [ 1735.435633][T21151] loop5: rw=34817, want=184, limit=16 [ 1735.484148][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.492163][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1735.503396][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.511575][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1735.532108][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.540580][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1735.551684][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.559831][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1735.595429][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.603449][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1735.617967][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.625993][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1735.638391][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.647155][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1735.658570][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.666625][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1735.678123][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.686115][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000000ff2283b [ 1735.777838][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.786121][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000037e9aa08 [ 1735.806250][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.814562][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1735.827778][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.835927][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1735.847079][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.855237][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1735.883051][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.891202][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1735.910268][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.918267][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1735.930787][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.938849][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1735.950554][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.958531][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1735.969967][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.977988][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1735.989541][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1735.997671][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1736.009975][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.018030][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 03:11:26 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000fa010000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:26 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x288000, 0x23) fgetxattr(r0, &(0x7f0000000040)=@random={'btrfs.', 'user.syz\x00'}, 0x0, 0x0) 03:11:26 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup2(r1, r0) 03:11:26 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xfffffdef, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:26 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x209f02}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:26 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000250000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1736.029264][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.037530][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1736.048745][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.056738][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1736.067949][T21123] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.075941][T21123] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:26 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) write$cgroup_pid(r0, &(0x7f0000000000)=0xffffffffffffffff, 0x12) 03:11:26 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000fb010000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:26 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000000300004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:26 executing program 1: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r0 = socket$inet6(0xa, 0x1, 0x7) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r1, 0x8935, &(0x7f0000000000)) ftruncate(r1, 0xfff) fgetxattr(r0, &(0x7f0000000040)=ANY=[@ANYBLOB='sejurity.-:\x00'], 0x0, 0x0) r2 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f0000000000)=0x3, 0x4) 03:11:26 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xffffff0f, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1736.138976][T21172] loop5: detected capacity change from 0 to 16 [ 1736.276996][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1736.285686][T21171] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:27 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000004020000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:27 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000001200004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:27 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x100402, 0x0) fgetxattr(r0, &(0x7f0000000000)=@known='trusted.overlay.nlink\x00', 0x0, 0x0) 03:11:27 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xffffffef, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1736.338410][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.346789][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1736.362704][T21194] loop5: detected capacity change from 0 to 16 03:11:27 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) write$binfmt_script(r0, &(0x7f00000014c0)=ANY=[@ANYBLOB="2321202e2f66696c6530205c202f6465762f766373610020202f6465762f766373610020200a7377b7ebb781d000b6334ce212d12c43e2ab95797c2b555c318504e77987e786c5f1094360115b82164f296dab680d675cb741cc3caf9a6cbcaa7421e7380eaad32cf2bdfa7fffc0391c530b4b30c311d8289ce088197860e5a35dcdf09ff0ab33a7b196291239a54a8aa34fd10519dff75651facf40ba9733385f29e46db327bf4b2d84f704dbcabaf9db0400bbc87ecffb5930ba87194319241e2d9818cdbb91c367d892ab47928f890393d8e2aa4096ac245eb77fe2e1ec958fd9773f7a1853c2c58382c006362e7967f7fb47fac3f32a58ee807d0ce607b32f3ce9e04c68b55837a0bd359938d83ff285d8044ab63ed466d96f425ada313087cda4b5f5342dec6dc6fa63d9a7113fcc672808afd0c06393bfb58a9e9fb98945a015a405e494d2685b2d39c34762b7f010209dcec705847503f87059750a16772546ca0e5bc435e1e4cc2e3ad045f5ba77f404eef977a6adbcd19abe203dc677f19103557873f08adec318fe259951014b5526975aa39e6b3a97a3357ae2c1606164518a61492cb875e3891b59fc5eac2702b4e4e5f8e723b5f7f750b11fa14fa95a92683e65e5705a97dbd970aec9117b9f18c003d84f3d55690e20e28a53b758201b56988c41d0fcd3af2316f3f25112645d72f560369d4626540b4aee74b8e9239dcf816e36272ab5a99fe659c8385f2cadf9d79155de36269bbd7496707d45c18e89376c974897ed5c31f59b5fbdb13a57f85ea13a9837cd03c9b24a7d7e98ab28465e62f1dee9541d9e06d5d0f309a6d299dddf376764aac27fd3abecef6169e3a8bc44b5db7c22496ae406eb321c7aaf66177728be2c44bc5d0dbc1f67a28b7b4662712e91643da19a75538aa88ac2bd4637240969070a187430ab9e387bd23dac5c4cace1cb4bf2264cca0b2f0cca72b8e7188af9f5257ef5d704717f935f115eb811eba51e35f6b889ce73ac9bda1ea4416702c6f873103bbf130b96021a90c4f4ab8ae66767a3b46b6c2da2885e39fa4eefdd3ba03c8e46564f521c3580178432418dba954b011fc544c979b9a4eb1c9e7dc866e1b1ceecb90b78f6d177f9688b9bf82e71e16e2d4cfe9a0456276bce1fe490f6ff17cf3e1e8b2a3934f1b46f4b2067bd1af7d33af82bb17579dfa5eb3989bae05f666004a6ba050ddceaf23a4e3616d8249a43fa58139d71c865b399e790ab8f4bbf7d249b158eb8d6d16fe49403e5efb9901d646e4d88868fab3b4b07c504ee47efdc4054fe992abd2ec7a2db0a8c649640cd5fd6e89bae5918a104b2e1c1afda3ba5683162423175d7d9cd7d1dfa6ec623604e3bcdbee974974e0ad65ebea776b8f317f65045643e9e2f961831f1e089117235d5101557ec28b1ea679216c57e0a9d1e972ccd8f07dae99a447aa8531f2958e842b5fb791fe965fc7d196443b18d9bb23f679373d34c0d2a8184ed22febd8b3e9a821cf395e938fd41dbd84d97800250b7a0b5f324727e045b60b58dc9ae3be63210dc3d9d9264a9d081beade36f021e286de49a9816af275a6fb0e5950805465d6ff365398ae3cacba3144d36fe4abd30fec058b891c891e33256eeeb067ed8437ca8f172bffbd340f22ecace86ce9b1cbcbd5acfafeccb2132b7f19aaef8a4ed42648ee31624f2a2d090c7a5821272f10f59c0a00bc2d7fd173dc05e4968bc3ed224a68a6f1c945eab253ef045a5dc26b283816e0b5a346175efdeb17b05f023e51853696b80f9d027fce567ba219bf8eba285a2e07349902a2ad50e371474e2107031e9e9a35cd95a7993d0b3ce749d799d1f30ecb4348fd930481d0e69bf8279a8452580b2142f4df2f14e91834ae6950ef84b52a6191e0e25ae2da8ccc23fb53b356dbce5423e515d6cccf4389c55ca57f59136842d11bdb51796eb5e3c54f9e58ec862f2e69e3f84324da523d6929663f5bf52d665c4dc33f26e65c4d1862f6ceda4b62ccde70a9e250ecf9774d85b4ce60ffeea350831a69d15efed8cb6148ff752fb61614501d8a32a2368d80354a368349d1c31cf8dc3cb16db99ea968b535418b4a9349f63cbd7a8eef5f708fd5049419ffdd56b301b0ad2f42a9596b7d0e7f0bb93e1c30cb03ae57780f33713c158a76704aab7feee9fc07247863239b8025c8a7c22a3a9cb2f87eff9c44f1eb6d9624c2bd4d1b1334610eead3d3ac0d9eb5afdab9da826283b1e7ccc10363a6dbf3b75c61652cd7d8909808364d3f70844ce5b67fd0547c01016bfbf91404a5259cc9a89754a193af8b0479c8cbb7f2340384732fe4cfb22b195b04fa2eee19498cd2ff665baea4daeb4d19345d44f22a18f416ec9faad1530344a3e11690632bca5456c1ff15989a2806e84253e8796321820da27d29a95506e97ad9a702516ae20c0e0fbfa5cb0fffe9ad44d6d0c5ae9c6a390816b59708d96b9f0e6e956e30ce5e1458c66f652b6dd26c73974b0efc3093c733ec899fae990a190475153119f97dc86b5137bfe4ae8dd1c6d369ca1a56fcc5aa77b47c69421d2e438968bf9590d1f627a39e06a2978f0ac379674c440487fe08980f7ef238bb5cad4efbd4247f6b5320d129805d9b6236cf0f64e8dd62abb6e963e4eb3e4442a1c7c4f767daa2542a5f828301cce472a34a1a2b17c3b426ff663cfc3ac0bac7fbb3905589e532cec7bc1d77d4340bffe6fd21b9627b919804325b3acdb9c3f371c79dbe3486df4365a8dd8205c42d8000c7dc6a43ba0798b88ab704fc65597b90bd9ef967c28699d4dece587b22c3bccd3029355b4df1012a67e3b7e8efea5217067e4d101193c9c09545e9e4cdff35b8b7616554488c212ae2d97051b6085759ba095c097fec1f4717b706f3710d87d2d465be14a649bf83eccb6eb1f286e51b620c2d905d6428bfe29343f12dc70bbbd7bc3e9df110db65302dd05b712186ee7b435e7bd05e046554cba9c01c118b64b608bbfa532038a97f519c3d3ea503717a403b8a6353e2f6625952cee73568bb14eb50778d935a26449a2f35fa4be40ee83bf588adf876e44c8140309bcf959bcf6fadf44f951d88924e8ffb862bc8c0ea50d8856622fdf9796f33036e51dc39bef71e32717c95b3460d59830720297914cc818fe083a0300d2c4ab48779d3346c65912d6b56f9b9b9ae7083947dc8b6fc1e328ed810e07776169882c43cf386744b70773915aab66040273ce8029316cf47d4812e9cd2f319f8720a89ccf0a9ad9282bf3af1e9b1c441505c0a6a786189d6b728f6b247bf4382867eb1dc3429f242c1cc3cb7ad20c6982a5cda99660a2a6d1a7f5c5f25343baf82fbb9539e0a85b6524aac74253841ee6b4869263a8fd9cb49d5f3c0f8a40aa71180dbbc86da44d40a55d160198d6e26d5cc10f453bc347daae6086f9971c9e290d1cd8956a7885f78499d35f68f8c5c003279572c42dacb43c273bae83e59cbdedd96f86287d04f39b5e801e9e76d5e5a6157a0f393feb66ef8e4c596f545c90f267789d363934fd445441783167d09570b6f4f7596c4b1ff76603a1eb5d72172b48f9454b5d8a570ae20601522d2b0e45246c7aebb24227ff7467c8b5393e245eb6a78136af3299b9e88c7555daa2ee4e763f55dae48a70a5545c4d6c8701ccc832fc737a89acf31f51a07dcbf92fb7b765903f33a984f52e35ff6783276a07ce85c00421d7b8fb1630b8d8a081dabf1490410ad5803d1cfc226bbbb4cef48d1ec45f0f90ee587eff01fb344d56f79690407b0d7e8d6726457ba0a1ffc10b217f3931cb03b68730bac06e3d4c99faa3e12035467c1fad6cb58a7919b4b5b261c1c53f4bbd25b96c596e2ac64579ff5f90d82aa69dcc80bc9ad09caf85c40c02d31a6c05c188f4f2dfc9c3efbdb8f74ff09725b98cbaf98c8824dbafbcfa7cd49f2caf4db44f672b63f0b8dc2a104572cf8e058553f06b13ad6d11e699e9215b442a422f16db23264f163ec3fc160ed755d1b83e1382774b98c1239076289e4d37c613729ca03d9d465ac4f7e8066f09060f0e87e23c6dd4e1a160a7f52c63b8e3fa34c8a778608b68bf90aace8729ded64faff1711654010e00fee7094009fb67b05f4ba5aea9690fac4107d7f9e4fa4ec46be5272e5aca0e6a257729867e5e81ae04beada2b983e911f572ae6944b0ee29cf926da9882f2680b2c18006922a5e765915efd885d2177ccdcd9ed39b67e75328e7485ad957cc967db406f0eb176d4ca0974bea0d261ab0d23586673168c3e360a7c90863a35365c25b0b5ce1046cc82c903111b27d265b8344a782ba80fb359f737b6003a3529f9f3cc1c6cd334b3e142e0258e406722e8cb05d6ecec870be3a7b6e014213b49c70ad1758a7013ecd6fef77477fbc9fd93955f746bd0e032bbd6cdfe7bf34044afbaf545b1e9b52ff5459e56d9378b6e7a3b2d5203aa8dd4f75207be9a06000d08746e30cab88947dd0e5a0a3af0dea9a7554c1ac2e5771a606392f2f1f4ebd6bf9ae8ed9c5ac2c4a38e66fd3217a1baee7f071583d35c312ee37673198e8b9e979799a19701235ae2df06a26a59e5fde5853435bc6a6baa0812e962cf581f58238819b9361ba2b4763b9d6a1d8d858c8cbcb0afe877b58e9591f24b21153a1ba52d2f69189b1a1f5ae635d51391d63c1a30ef406ffc324a20ea9b0df7e67079f7538f95ae37c453a805c9835cd5d127c65e5b6c1265d0b75e5b2fb83157fd70ede11746970a1e2ddc4fb0463f421dc788b2d650ea897986486fbaa70d407e07b89f64f731a5c3bb37871bb46122325bc2626c09acdee295785a84a518041e5c8ce3c9cf67c7fd21f7f8bfc9f10ef773e93845cf2e4005a4dbbe36718ef48cf0d2beb7c5ff9661e8419a2da6dcc66a88262e1b5fee2cbbb3ad21a22dca8021b7b56dc1dd4112130f8db95b0c8bd01a849934700c4f74661e4a09e06bf27b39e5dc562934c562d5719eb26dd3f96042d37890f7a808eaf7f972d8be7306ce6427e3ff452895c092a5ca707c2de35fb64972d013b3a4278da71881c0ce5805f9e1683241586305e397db8fe8235b295e4d56c130b95c1cbd06e22c9b6728c99f390306cd6a1d993a9ac0c309c08a93030aa436579a6d2338542848d03670747869ed3978a4713155fc5f5b80c5ceefa6364c031780af31691da27f4d2bfea65c2c5f9e8ec8dcd192d3d8687012e57f27071782bab6abeec3e0c9bee8d3eb2c58ce7ebabdd04f322cec93d332ae7d48f2208632232396efd91dbf1f88a9aa1d0b0a432b73dd39935ca1094b888b6545eeabf2e2bfd587cef71a519567f5028bdd1308f7754ac4c8cc331c94142b6cc124e14b1860ec2a3c7d45e531b56fc8e546f27e518e8402dbaf9b77e9c5f09ab8795296fb04d8fbe201b18940f385bc6eee4dd10c71aac4d77270861f242b184df3df769c67fdb2debffbbac4e2a77b7a7181c5608a66c50ec133428f86a8f4ae561be5c3b6a5d1c317c03cc31e2ae5b4bea827c3af60257742933a5e2de3d856a082aacc89d8a0a37b76e6ea5988bc4f69ad89cba8b5c8739501236c02a9f1dfce128abafaa12ebd98f12f0810b17ae2e014e83ed951b0ca0ca02079f52815f8e3e171451ba869c8c8755c4e7a3ffefb50aabfeb2964d96aab00a4dad3e9dbdc78dd7caf2520bc1c38d4fb8de0908f83926b9fcca2179d74f0ef03115f58f409ffb65b4ec6938ada6d97f15315932ff9b1f79ff2de60828c14ced002d88226237d6d2099a17cb0be8f5ccd2a078070cc703eb068d845eb1ef18f7ad44d7f65c6f387824118b11f3ae5cc7a768b16a64223d0359fc12d6088404eae2898e"], 0x1026) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000002, 0x2010, r0, 0x5a044000) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r1 = socket(0x11, 0x800000003, 0x0) ioctl$RTC_AIE_ON(0xffffffffffffffff, 0x7001) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) bind$packet(r1, &(0x7f0000000000)={0x11, 0x0, r2}, 0x14) preadv(r1, &(0x7f0000002500)=[{&(0x7f00000000c0)=""/245, 0xf5}, {&(0x7f00000001c0)=""/207, 0xcf}, {&(0x7f00000002c0)=""/156, 0x9c}, {&(0x7f0000000380)=""/139, 0x8b}, {&(0x7f0000000480)=""/4096, 0x1000}], 0x5, 0x2, 0x8) fcntl$getown(r1, 0x9) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000000)={@remote, @multicast2, r2}, 0xc) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r3, 0x80045400, &(0x7f0000001480)) [ 1736.388201][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.396656][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1736.440461][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.448657][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1736.460482][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.468805][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1736.488415][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.496736][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1736.508248][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.516352][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1736.551137][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.559386][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1736.573461][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.581470][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1736.594281][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.602401][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1736.613848][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.622169][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1736.633631][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.642097][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ea8917f3 [ 1736.738349][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.746546][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1736.758386][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.766623][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1736.777821][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.785955][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1736.819570][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.827598][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1736.863186][T21226] loop5: detected capacity change from 0 to 16 [ 1736.897135][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.905274][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1736.921662][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.929749][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1736.941728][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.949766][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1736.961509][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.969540][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1736.981169][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1736.989382][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1737.008592][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.016856][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1737.028112][T21171] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.036206][T21171] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 03:11:27 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:27 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000005020000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:27 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000ec000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:27 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKPG(r1, 0x1269, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000240)}) preadv(r1, &(0x7f0000003580)=[{&(0x7f0000001480)=""/254, 0xfe}, {&(0x7f0000004800)=""/4106, 0x100a}, {&(0x7f0000002480)=""/59, 0x3b}, {&(0x7f00000024c0)=""/4087, 0xff7}, {&(0x7f0000000340)=""/170, 0xaa}], 0x5, 0x5, 0x5) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r2, 0x8983, &(0x7f0000003640)={0x1, 'geneve1\x00', {}, 0x4}) socket$inet6(0xa, 0xa, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000003680)={'sit0\x00'}) preadv(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)=""/121, 0x79}, {&(0x7f00000000c0)=""/40, 0x28}, {&(0x7f0000000100)=""/11, 0x1}, {&(0x7f00000036c0)=""/225, 0xe1}, {&(0x7f0000000140)=""/132, 0x84}, {&(0x7f0000000480)=""/4096, 0x1000}], 0x6, 0x8, 0x0) 03:11:27 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x1db680, 0x0) lseek(r0, 0x100000000, 0x1) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) copy_file_range(r2, &(0x7f0000000380), r0, &(0x7f00000003c0)=0x80000000, 0x9, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000040)=0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x4, 0x20, 0x9, 0x5}]}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000300)={&(0x7f0000001400)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="045ea70e1500fcdbdf2577a4f8ff809bbaccc6745847ff936109c0eddf6d88071f102c3b6a9a7f479edb5d5283841267c9abe85691507f88a442d0116ce3c3205e34fd71e7c365895d5a428f60fd00"/89, @ANYRES32=r5, @ANYBLOB="0800ef00080000000500ee00ec0000000500ee00e00000000800ef000d0000000800ef00030000000500ee00020000000500ee00060000000800ef0003000000"], 0x5c}, 0x1, 0x0, 0x0, 0x44001}, 0x40c8000) r6 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x204}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001a40)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r6, 0x50009418, &(0x7f0000000400)={{}, r7, 0x14, @inherit={0x88, &(0x7f0000001580)=ANY=[@ANYRES16=r8]}, @devid}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000080)={"f1cd92d50459962e9260374c4d304856", r3, r7, {0x100000000, 0x40}, {0x20000000000, 0x7}, 0x0, [0x1, 0x8, 0x4, 0x6, 0x5, 0x7, 0x5, 0xff, 0x7fff, 0x5, 0x124, 0x3, 0x3, 0xfffffffffffffff7, 0x2, 0x4]}) r9 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r10 = dup3(r4, r0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r10, 0x81f8943c, &(0x7f00000015c0)) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r9, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x7f, 0xff, 0x4c, 0x1, 0x0, 0x20, 0x40028, 0x3, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x8, 0x1, @perf_config_ext={0x80000001, 0x2}, 0x808, 0x0, 0x0, 0x1, 0xe1, 0xfffffff7, 0x831, 0x0, 0x3, 0x0, 0x3}, 0xffffffffffffffff, 0x6, r9, 0x9) 03:11:27 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xfffffff2, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:27 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000006020000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:28 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000f2ffff7f4500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1737.215829][T21253] validate_nla: 42 callbacks suppressed [ 1737.215842][T21253] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1737.226051][T21255] loop5: detected capacity change from 0 to 16 [ 1737.241661][T21253] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1737.254980][T21253] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1737.258100][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1737.264653][T21260] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1737.271360][T21250] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:28 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000007020000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1737.317505][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.325684][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1737.331167][T21271] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1737.348235][T21271] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1737.351307][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:28 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xfffffff4, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:28 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000f8ffff7f4500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1737.357810][T21271] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1737.364616][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1737.374120][T21275] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1737.436018][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.444071][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1737.455791][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.463903][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f 03:11:28 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_MPATH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, r3, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x0, 0x4c}}}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008000}, 0x20040800) sendmsg$NL80211_CMD_SET_CHANNEL(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, r2, 0x200, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0xfa26, 0x6f}}}}, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x3ff}, @NL80211_ATTR_CENTER_FREQ1={0x8}]}, 0x40}}, 0x8000000) ioctl$VT_WAITACTIVE(r1, 0x5607) [ 1737.486331][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.494446][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1737.506218][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.514306][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1737.551256][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.559351][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1737.574135][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.582145][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1737.594802][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.602980][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1737.614187][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.622207][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1737.634547][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.642677][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ce98e5d3 [ 1737.662073][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.670273][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1737.681485][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.689537][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1737.700694][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.708658][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1737.741202][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.749285][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1737.752337][T21287] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1737.768607][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.772713][T21287] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1737.776881][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1737.796824][T21288] loop5: detected capacity change from 0 to 16 [ 1737.797669][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.811041][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1737.822434][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.822447][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1737.822811][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.822822][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1737.822861][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.822872][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1737.823694][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.823705][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1737.823919][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.823928][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1737.824044][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.824054][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1737.824092][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.824103][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1737.833018][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.970631][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1737.982670][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1737.990687][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1738.001966][T21250] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.010025][T21250] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:28 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000f9ffff7f4500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:28 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000016020000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:28 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$TIOCGSOFTCAR(r0, 0x5419, &(0x7f0000000040)) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000000)) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x44) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r0) sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xcc, r2, 0x300, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast1}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x8, 0x2d}}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_SERVICE={0x50, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x58ba}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x3}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x10001}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x40000}, 0x24000800) 03:11:28 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400001}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:28 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x6a4900, 0x0) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x8, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:28 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xfffffffb, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:28 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x179042, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:28 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000018020000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:28 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000feffff7f4500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1738.066333][T21302] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1738.074621][T21302] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:28 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000000)=@known='security.selinux\x00', 0x0, 0x0) 03:11:28 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x27e080, 0x0) preadv(r1, &(0x7f0000000040), 0x0, 0x1ff, 0x24) 03:11:28 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000000900000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:28 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000029020000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:28 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x521000, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x20, 0x0) mq_timedsend(r1, &(0x7f0000000100)="f7e6bf8644b9c8be459a6f4a63ffa760c2", 0x11, 0x7, &(0x7f0000000140)={0x0, 0x3938700}) r2 = pidfd_getfd(r0, r0, 0x0) write$binfmt_aout(r2, &(0x7f00000001c0)={{0x107, 0x6, 0x9, 0x3cb, 0x1c2, 0x3, 0x352, 0x100}, "ce7588c3f840b75fc8dad11518967fbadd1a75080944153cb58cb84ac7d94867fee3c0e072b5dd566dd1e96e1182e065292482e160bba94cc23b8b7de602bc0aa5caf11d4ab4842a91aa3dbef01c51804cda4633aa02e2715bcce1fa1f18049d3e9aefdb30bc4a803d76bd3e27db35450806a7ca7ede6f3d03643dfd04d9c21d095f4c08254a0c1014c2ffca561480d3734c1d839a3443beb832498032bf43ecee7afbc4f2689d70a1125ecba45cea0b4b1cd086c9a53a8910016449aa3d7eedd25ebdf7df21c006e468e6be6357d48630311e30556d0a7522def88d6cec87cc973b4c583e005966bf68ba4074b14e564569437f4afeab678aa199", ['\x00']}, 0x21b) ioctl$BTRFS_IOC_DEFRAG_RANGE(r2, 0x40309410, &(0x7f0000000000)={0x1, 0xfffffffffffffffd, 0x0, 0x1, 0x0, [0x9, 0x81, 0xff, 0x10000]}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='net/rfcomm\x00') mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x50, r3, 0xe3ee000) [ 1738.120889][T21317] loop5: detected capacity change from 0 to 16 [ 1738.150346][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1738.158663][T21318] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:28 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xffffffff, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1738.200754][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.208989][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1738.227735][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.235761][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1738.281112][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.289121][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1738.300416][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.308573][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1738.328955][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.337117][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1738.348353][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.356648][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1738.394445][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.402462][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1738.416418][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.424425][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1738.437416][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.445427][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1738.456570][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.464787][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1738.477013][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.485267][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000069b7dbf3 [ 1738.504892][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.513180][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1738.524372][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.532382][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1738.543582][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.551710][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1738.587755][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.595955][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1738.607963][T21352] loop5: detected capacity change from 0 to 16 [ 1738.629423][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.637439][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1738.651170][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.659320][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1738.670742][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.678733][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1738.690478][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.698727][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1738.710480][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.718502][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1738.737312][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.745772][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1738.757329][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.765888][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1738.777106][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.785235][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1738.796563][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.804576][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1738.893207][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.901370][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1738.912634][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1738.920664][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1738.931827][T21318] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:29 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:29 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000002c020000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:29 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010200004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:29 executing program 2: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) fgetxattr(r0, &(0x7f0000000000)=@random={'btrfs.', '\x00'}, 0x0, 0x0) 03:11:29 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000000)=@known='system.sockprotoname\x00', 0x0, 0xffffffffffffff73) 03:11:29 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1738.939831][T21318] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1738.982999][T21366] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 03:11:29 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000002d020000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1738.991429][T21366] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:29 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010300004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:29 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) r2 = openat(r0, &(0x7f00000000c0)='./file1\x00', 0x600501, 0x41) mmap(&(0x7f000067e000/0x4000)=nil, 0x4000, 0x2, 0x13, r0, 0x580a8000) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800001, 0x12, r2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000000)={0xa000000c}) dup(r0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:29 executing program 1: sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="0e193b18efe182e5465eebe6bacdb6f28b53864c783d7804bd90f9bef2c46f5aa677c658ba98ef175e90c3ab7cc22f9ea873315a03a9e86cc5671546697fc404af3d58d632a82edcc9e9ed2872cba1ec10b6dc6884c81c2efa675b544f91e291c47ab25edc1b1711fe9df5cf", 0x6c, 0x4004804, &(0x7f00000000c0)={0xa, 0x4e22, 0x6, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xb2}, 0x1c) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) 03:11:29 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010400004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:29 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000005a020000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1739.042779][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1739.051180][T21381] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1739.056332][T21380] loop5: detected capacity change from 0 to 16 [ 1739.094145][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.102535][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1739.125148][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.133205][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1739.180205][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.188934][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1739.200404][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.208443][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1739.227957][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.236006][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1739.247229][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.255211][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1739.291210][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.299376][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1739.313894][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.322050][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1739.334468][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.342500][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1739.354096][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.362192][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1739.373775][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.381784][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000037e9aa08 [ 1739.477004][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.485221][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000006b29f761 [ 1739.505486][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.513677][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1739.525103][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.533125][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1739.544333][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.552611][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1739.582266][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.590410][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1739.601961][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.601977][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1739.603375][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.631088][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1739.631541][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.650630][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1739.662271][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.670289][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1739.681463][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.689457][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1739.708254][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.716294][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1739.727747][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.735746][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1739.746952][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.754950][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1739.766079][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.774059][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1739.792507][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.800498][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1739.811909][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.820020][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1739.831381][T21381] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.839412][T21381] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:30 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4af000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:30 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:30 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000072020000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:30 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010500004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:30 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x1c3401, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:30 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/225, 0xe1}, {&(0x7f00000001c0)=""/206, 0xce}], 0x2, 0x9c, 0x1) [ 1739.879010][T21414] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1739.887271][T21414] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1739.902644][T21414] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1739.910790][T21414] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:30 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000073020000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:30 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010600004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1739.953274][T21421] loop5: detected capacity change from 0 to 16 [ 1739.961416][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1739.969900][T21424] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1739.991770][T21421] handle_bad_sector: 26 callbacks suppressed [ 1739.991783][T21421] attempt to access beyond end of device 03:11:30 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r0, 0x89f7, &(0x7f0000000280)={'ip6tnl0\x00', &(0x7f0000000200)={'syztnl2\x00', 0x0, 0x6, 0xb5, 0x40, 0x3, 0x20, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, 0x8000, 0x8000, 0x8, 0xfffffeff}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'sit0\x00', 0x0, 0x2f, 0x40, 0x3, 0x9, 0x8, @private1={0xfc, 0x1, '\x00', 0x1}, @local, 0x40, 0x1, 0x1, 0x7}}) r3 = socket(0x11, 0x800000003, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) bind$packet(r3, &(0x7f0000000000)={0x11, 0x0, r4}, 0x14) r5 = socket(0x11, 0x800000003, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) bind$packet(r5, &(0x7f0000000000)={0x11, 0x0, r6}, 0x14) r7 = socket(0x11, 0x800000003, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) bind$packet(r7, &(0x7f0000000000)={0x11, 0x0, r8}, 0x14) r9 = socket(0x11, 0x800000003, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) bind$packet(r9, &(0x7f0000000000)={0x11, 0x0, r10}, 0x14) r11 = socket(0x11, 0x800000003, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) bind$packet(r11, &(0x7f0000000000)={0x11, 0x0, r12}, 0x14) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000380)={&(0x7f0000000a80)=ANY=[@ANYBLOB="f4050000", @ANYRES16=0x0, @ANYBLOB="02002bbd7000ffdbdf250100000008000100", @ANYRES32=0x0, @ANYBLOB="6401028038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000500030003000000080004008100000040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000008000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004000500000040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000100004006c6f616462616c616e63650038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000050003000300000008000400f400000038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000500030003000000080004000100000008000100", @ANYRES32=0x0, @ANYBLOB="9000028040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004000000000008000600", @ANYRES32=r1, @ANYBLOB="4c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000019000400686173685f746f5f706f72745f6d617070696e670000000008000100", @ANYRES32=r2, @ANYBLOB="3001028038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000200000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="080007000000000038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000500030003000000080004000300000044000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b000000140004000800061f05000000030080000700000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004000800000008000100", @ANYRES32=r4, @ANYBLOB="3c0002803800010024000900616374697665706f727400000000000000000000000000000000000000000000050003040000000008000400236e0c529341a8f1177c", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32=r8, @ANYBLOB="e40002803c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r10, @ANYBLOB="6c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000003c000400008002083f0000008000040404000000050006030800000001000001010000003700020904000000feff320206000000008008050900000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004006706000008000100", @ANYRES32=0x0, @ANYBLOB="6c01028040000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b0000000800040004000000080007000000000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004000000000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000050003000300000008000400060000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="3c000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000b00040072616e646f6d00003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r12, @ANYBLOB], 0x5f4}, 0x1, 0x0, 0x0, 0x40000}, 0xc5) 03:11:30 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x3, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:30 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="6f73322e010012b1ddde9aa8df7becd56b2df9e2fe4037c1d0"], 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f0000000200)=0xc) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) perf_event_open(&(0x7f0000000140)={0x5, 0x80, 0x9f, 0x81, 0xae, 0x7f, 0x0, 0x7ff, 0x28, 0x4, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6cc1, 0x2, @perf_bp={&(0x7f0000000100), 0x6}, 0x8006, 0x3, 0x8, 0x4, 0x60, 0x4, 0xec45, 0x0, 0x8, 0x0, 0xffff}, r2, 0x2, r3, 0x3) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) r4 = signalfd4(r0, &(0x7f0000000080)={[0x7]}, 0x8, 0x800) openat(r4, &(0x7f00000000c0)='./file0\x00', 0xb180, 0x0) r5 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r5, &(0x7f0000000280), 0x18, 0xd9f, 0x0) dup2(r1, r5) 03:11:30 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000030000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1739.991783][T21421] loop5: rw=34817, want=184, limit=16 [ 1740.045102][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.052065][T21441] attempt to access beyond end of device [ 1740.052065][T21441] loop5: rw=34817, want=184, limit=16 [ 1740.053176][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1740.075230][T19085] attempt to access beyond end of device [ 1740.075230][T19085] loop5: rw=1, want=256, limit=16 [ 1740.088174][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.096253][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1740.144250][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.152290][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1740.163829][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.172156][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1740.194189][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.202235][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1740.213456][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.221577][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1740.258175][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.266200][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1740.280656][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.288942][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1740.301444][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.309732][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1740.320856][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.328870][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1740.340583][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.348862][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ea1d7aac [ 1740.436795][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.445366][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000079427f69 [ 1740.466132][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.474166][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1740.485460][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.493523][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1740.505046][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.513162][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1740.540978][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.549146][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1740.559683][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.561066][T21452] loop5: detected capacity change from 0 to 16 [ 1740.568251][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1740.570587][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.593715][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1740.605344][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.605358][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1740.605722][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.605734][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1740.605773][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.605782][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1740.606566][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.627298][T21452] attempt to access beyond end of device [ 1740.627298][T21452] loop5: rw=34817, want=184, limit=16 [ 1740.634222][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1740.634578][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.658400][T21458] attempt to access beyond end of device [ 1740.658400][T21458] loop5: rw=34817, want=184, limit=16 [ 1740.664731][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1740.725400][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.726203][T19085] attempt to access beyond end of device [ 1740.726203][T19085] loop5: rw=1, want=256, limit=16 [ 1740.733438][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1740.756452][T21424] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1740.764560][T21424] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:31 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4fd000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:31 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010700004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:31 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000052030000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:31 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x4, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:31 executing program 1: openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='system.advise\x00', 0x0, 0x0) 03:11:31 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x40, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:31 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x26a303, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r2, 0x0, 0x2e, &(0x7f0000000340)={0x2, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @multicast1}}}, 0x108) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000001, 0x20010, r1, 0xcecf9000) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/mcfilter\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000300)=""/207, 0xcf}], 0x1, 0x2f, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f00000000c0)={@in={{0x2, 0x4e24, @loopback}}, 0x0, 0x0, 0x3, 0x0, "3bf3b913ce6f2898c6f217ddd41137aada707f50a67f9664e99ce3a244d8d06c2cfd4b0dfb87bbf4b24f8bfad9f2ae3194e18ff01f30398ee6c3b9dc422c6101b4151c2833536ea5b105aa18a39f8d85"}, 0xd8) 03:11:31 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000002040000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:31 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010800004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:31 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000000)=@random={'osx.', 'trusted.overlay.redirect\x00'}, 0x0, 0x5) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/connector\x00') [ 1740.896719][T21480] loop5: detected capacity change from 0 to 16 [ 1740.924303][T21480] attempt to access beyond end of device [ 1740.924303][T21480] loop5: rw=34817, want=184, limit=16 [ 1740.956012][T21494] attempt to access beyond end of device [ 1740.956012][T21494] loop5: rw=34817, want=184, limit=16 [ 1740.968388][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1740.977610][T21482] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:31 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000006040000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:31 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010900004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1741.020987][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.029096][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1741.063902][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.071954][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1741.093490][T19085] attempt to access beyond end of device [ 1741.093490][T19085] loop5: rw=1, want=256, limit=16 [ 1741.133103][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.141141][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1741.154181][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.162225][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1741.184478][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.192639][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1741.203964][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.212151][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1741.242308][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.250393][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1741.264653][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.272794][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1741.285690][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.293741][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1741.328397][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.336778][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1741.353277][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.361316][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000c6b8909d [ 1741.381830][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.389862][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1741.401454][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.409621][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1741.420791][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.428826][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1741.456932][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.465265][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1741.485865][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.494065][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1741.506713][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.515158][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1741.526347][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.534372][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1741.546445][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.554625][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1741.565902][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.574004][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1741.585931][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.594038][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1741.605483][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.613580][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1741.624871][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.632867][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1741.644115][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.652133][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1741.670507][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.678528][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1741.690208][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.698259][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1741.709442][T21482] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.717446][T21482] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1741.747615][T21517] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 03:11:32 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x541000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:32 executing program 2: unlink(&(0x7f0000000000)='./file0\x00') r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:32 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x5, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:32 executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r1 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(0xffffffffffffffff, 0x4008941a, &(0x7f0000000040)=0x2) sched_setattr(r1, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000002640)=[{&(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001900)=[{&(0x7f00000002c0)="1b3163e32e48adb838d7e855629732de6566a7745d048fa47b56f5004c5e8926349e84f7f14baa506af8543344b30897e0acb67b5b7eda69f36f64e9025b0a0fd16e6ba1af138f258997442cf3c676e7f2d37b1bc267d52f80f738f781e91580fd9a2e39e3f551cb8850f5df14b26ac8d18bf612d4bf45a076955b3cde8d85f3994d509c3976ee67a2713f3577b9cfd35d1efbe40e97ad6652f8f05f38f192e527defe6988f0c082c8935691b8e6a6c741252151e5c99b1c", 0xb8}, {&(0x7f0000000480)="91a8a987bff4032dfd03c7eb59521bd100d4c72a57a4c43123c27c2eeb8bd7a1825031111e75ab2b1b99afd6fb1fffadd996354bffd3966d842da13033b48001a64f5a0fd1a219798d37d031a4c5c1509db4e824a639c7ce5e15d26a451065e3fffc8b0eaec09f13e7214090cc313d979a0594ce4ce1d8912cb42668a04e90d2b829b6eb25800e84f0d0156d9ca39803e42cd4d6aa564624c7c1f5a2c5ba16c2c296b2a8e551d127d277e5c27d348a1b92b038ed6c108b70fdb677bedf76b49d0781e27eaf38731d83e4336778fe03a0de07766fb2c448ddce2d541bc61ff993008e8b26d4a148051a50e38c2ba177f17776a511fcfc8a52752d5e4c44b26082f0ac9cb89a4ff88e4367cb1074e3686b85e311f5444ba4ef032da0d81efd5cfd0eede0ef3e4dd44439dd63fc07eb67d6646e89844d9065e00b52cffc52b2328b1cab92b1471a4ce5a2f45a4bb3639e3175fec801245b67b026f2773da73e68fc243d51f93cfbbb00ad3afbb6ad3d4b88e682f48e3feb365591919a56b3324552f2416b606445bc8a51f6377861c20147cd80f60c1dff06602ff34198ebb4f0ae7c22c48cf2dcb92a530f6faedb9ca26c255ac9910d4cf84684d706893dd32a8a68f03a5f220b9483624961c828d7cae8e2ba897a5f5befef7901be9d5ae762eda23a118640212fe98de2bc79a55d642587c6047318a71d64c78126120c23d96e73608b250e972ac3366b7e2ad595a84096a316648a25450a6302ac6c87093ea4491369048f929b4128791b077b8f3d9174c7bcb34c5c49b953d08aca4effdbc70e55006fab2b8fcf69fb1351c5e508c443025159f36c3b9dcb6c9076e1e96d30da1f8688f5288964b4eeded08fc21069d1eb67a89e012ddfc22968e64284decdd918941204eb1751ee40689576b3e01fe9288d6b34fbb340b8f3266a2ce1c4a7972890c8ae37789398ff24e55dac048e6364476ac6b9ab18402679b4bf4180a168b1697851ac60df68c467d3ba7b6bc490fdbe8641fb9dc03889b10117b9aa831298a6affa6de0dfbf8e6f5b41f3eb47197710bcdc8746f6aa83848234bb2026bc396eeac4e9cfefdcac43a347963e6c1fac4ef8359a07287aae295da08a33afc17921c59dfd43c8ee966a256a8aaa1dacc0831cc9d7706a6e7c94e12674233d2000ed915495616309365db66bc6f1523db466fd6b367e05fcc74858042568f870dfbaeba9ebfb7f04977c045a4954f313eb15cbd39a178c9254c6fcceecc01f56b1dba5f6724567bc262670d1a95b423b629ce1a36acb22a4be3dba47a83ffcca7bdad48580e15534133edacecb133aa65f29b52316e79f860f3dcc24c6a929cbb45e836681ba59523cdc27f10ac966245d40a8638701f171021b1b06ffcd5d06fc5d23ccfd85efb7700112c41800780308a4c4ae01cd0fd301265a0f31a26769de03029995b29a061a31601fd627458086ca7b37bd3053c7e33581767221a65c5a0b7103ca1e6a71db7652356b72156a4bf381208cedbccaac34c50dcc774d57be46c43df8c1fd4c2bf63a3f8a99aa042573063971fa29e52f4969d9453564b3c8da759496f9b5707bf11dedac66fe9c87444411eef55e81b103030e98ee9d067df0a45e6edb3f05ad5b418c0c7e34e713652802402b983747f0746fad7069973cd2480d3239341eb80f029f4f6d82fe1bd5cd41c11eacc2c58a1fc33cfbee592de71fddac7a9c8d64e0cd8e352f7b15325dfc8493617d83bb221eacd0d7a27eb86f44937ad9f032d99891cfe61eb6869367921f7f3d3ee2dedb2ef488c098a094d053fb2794660ff8e7840714bf05ccb049cabc44adf3c080cef0a19f7790f6e9fe1c28979d98182fb6effce137b2a31be14c6ca08b56f323dd8d0cdfee84ad10faeeee006cac4b390875b8f91491c4687b224c83ef6c80d1ae2af560b156e4730f37f00861d6d529d2900018b1541001c00f109bbe74639ad992a7205c2878bd4de24255b7e4f5ecd76d8eb8b69a5d8a99b97cced94abb9a8f82b6af4a9e35d4a4b9be64a435cf95fe5c3b6100ad1dfe393e7f8b3736fc671014280848dd62b8077eb93c4023443fcae46817300fd96ff9babaf5380cf05461afb94e54852df1d8546fcafa1da3a92bf4c7071213051b9a12af5f9d7eae6f93df3a0ee2e9326068ed1300d5725121b8aaf908c367f7ca4af469e2c71b754cc40b4ab13e8aba2a34af4c769d002f9ca8bffb6a069ced369261a32a880e9b334abcefca3f3dae013ead49f28f42c7f536a2a60c58f28d51d4a9efbc103fad719418a65a617e6fc76b15b8fe1df586b231ce001ca531dcafef46f5205c28b90baa490222bf0eae1b72c4da2e063050d9ed0efd1a35c6736c3e6e6f2f12829129b1e53a05050e59a44ed6b13ecb2576b1d4cf0d50594fc3a8dbdd2bb88e896418fed8a170c5b376f774cdd47940a7b1ee84fdc18e06e465a7fd196dae9bc2d54742d87d56b5378cc913572996343eba4c96edbc38833b989219db959b633265931e9ba23871aa50d764a844e894bc36be72332fa791e004082da9af32ad9838db407be6f5f61d95dfe928a0e37f548056195341792c53bd1827b943adf420bb52bb5490d30d85545d7b26dc7d1bbbe833c51aa20d81c5d115945e2d87307220a2232b2a67a5f8875da4cfd084221f3895f69c2d66602d2fb892285966f2dd7655a3d26e78ac9c1bdacb18de92b9745770faa72b3ad463299068df646585f9532d67f9eeec9ee2d76e5a2d6fdcdb5ebc999e69de4e97ca77d4c69a59a1ab4cf725dbc92fbea63ec2d3dfcbe68d8f63b237a9fff053c4d6b53607846993eda4428a802c1e1eb77fa2b28a3f6f259290aeacb5d09133f113c12683902502e0efd84ace4c9c06d6b8103d4cd74039d032c863f059fda2e58fa98916e3337c1e902347d39b3b7785f4990c87e6e5f055f1d702c0a9931604d08c8e99a41dd9f06fa9e106d3a295ff5a45966d96833dca97cae747835ca3e612a1ef702a857afbca2a7b12ff2885f6b3263902a75e03fa8293d84c1d33eece9cc2d1520db2979f986cfca0404d6bf11b586368de9ff766227a1e159e3d74149ad3ad3c6f4366a054a8a22ce9716b778264683db2d1f4a74cee89cf0d0646de2b34ac1749e97f1b89d050b145c440cd0691e2e97e99779731ff28f3dce6d5f083edb11ad5eb42b6496e5d81ac21af6173f228fae2b36fc33d7d2f997e4753e52aebe020fa6e81a723b96092efd697424bb70ffc34cef12857a1ad1adc9df6559a61eb1b7890cec3344ac63b91c9c2565c871e57eb5c7424d07ea8449429425cea9c9726f49581b22a391ada3d00494e919aa0e6c33a5117abbb3fcec20b26d198ed5e710231e770302be883e9bbcd4d36ea0597b513193631899daf42a7ba66fbbc53e3b1d90b9b325ed45432132a0b637bacfaf2f131ec1fef8650e2ba7abfaf347f1dab8b931822743672a5724afa69f74fd319ec5f2189876dbdcff7f3314997f9c66b3a0266c8ef12b4fa75ab3f6589d97ce8ce0b9f541ec6ecdeac246dfcbf240b43e48b550d86a2fb615493720b5db8caf867a4b70eba6905ace6f6128a035a075f473969176be529886ae536bc99450e8fd64ae063bd58c9713e6d61b91f7eaa56d6793e1f7c7c77499b4334186d41b601052031756cf4c62ce48e990c938fa3c17e4a19665bffd562b3e0c2fe9c27d79519281161d7eeea6c71f25c0fb71d300cc61b41f0f68a8c6ac8e2dfe2d53936b13c011938941b41808ca15cf7c000e9cb3132aa5a785c38ebb92caf0008433ac9a12ffd72351e7de74918fb97f2155017cbe2a19501f559f278b9d40445a116a0e9562ae309bbb9ce48585c9b58677a5993e7294c059a6de555eea657839aa0256e3484faa03b30e8e843480137dbe72e806da40b51bf073a4a9d40c6602702aa3b4badd02b9b4138d6692d46b89a270d5f08f95fb1e75377175e7877f3410cd954ef8658a13af32fce49116a68b08ff70ef2d4b0b46f9e8db10b74f39c09fc43ce6dab3d4870585e1e8bc621ca8816a244bc69a0d3eda0e8db46028b348e71563142879696f57e1cb6980baddfbd214517c14ccbc169ddc104b33d141fb452fefdee73e29d106629611e7c40cef0b2c77fff3664ffd0ad0a43e3fde31518ec454055032902bdf1622e16174b972e37cf4a545a368c105c7e3098aa9537d8d98a69e38d5dd5cfb765184a51c263b7a448885a8656cb8da5749c968f47a1ef1c8d72ca19b2eab4dc14a0bbea62aa664c7a300a67e3cef46e4313f3a7c3ae31ced8606c8d9391a1a1c1b40a4d74467dd38d3d546d22069e41b482d0d225958cb4146c819180cd6eb64b6a48a71070baad46dbbab7756b553568da0dae9b44e4995d03ae46f376a14d4ab21f083417a74de1cf237b32e043d1adf1919624da94807d47fbca230ad89987deeed106e53cedb8909b59f27cbf7de801ec54a4f3ed4cf790f72409248bdb1c2f656c5d92c90b28783c0ef05f1559016d9536ea8185f2b7e7b175a359c6fc9198dcef9072b8da6a8f59bb5e29d720a443f014b3726ec351f85cb63124777ccd718da762b268e4a0a6aad383e7623a8048f72c27fc9968e04aa2921a710c0d3115f88d50478aba4dc01d24920f22a096414fbbf2a6e52feeaa2e7d9c014cdcb85c0e8b99d9fe4999ba02028e88eb931a7a890e92155c1dbce3683777debf6d890cdf6b2a8c10e548fb96cd961a3b540b3910a02aab11df1b7b60b457b09b3e1eac220fe6772b1319cba7b997b27ddb98e8f2e5685b1951882c7df3a6ce227ba7171fd74fbf02a2e086405a7b0a5d4fb1e55765c447f11541a716f3fa2d6fee4b311357bc5583e45be964a7d978c2198c28a35809668f0dd99623795660b873788d33b700739728367450524890f9aed8d89a67241ee30f0bad17f05253a7f3d63c4e9ef37093b4da124427789b02398081aea1c7160566e28e198d71944e8c9b9ec537fb18ae61e8e0810692ea1e17511412dca36933cffaa2c347274f0084cfac589b5220ddb5794204640aac5eca0d5006a3c371b389b27d485fd85e4051ac64cc4b7249baa5a6166abe03048333091f9c260c1aa99d58121548b84bf64ff4c724734a91f78c0f26e343834c1edf511253e6bd1845047486593b4b38543e90a235662be52fa78fdd999ff9450fd6fe77e9446ddb73160e6117c028e9c1a9b9fa8d67d67ef438f1fc5f8b5e5062d8c959e0af9ba1eee0e7092f581d7bc60ccbab30d770b0b370dcfc11565a993165640a24589195f4146f313e745c212a818dc6a9a04c600b9c9fa606096c11d08ff5c391f391e0bd8b45d2374e4c03761f68e6ee0b3491212edf1e9d09ec86ed50f931d5b0b8800a66489a55245f58e7b0b02d04a24f5b439e5f545e2170ff70a5c8bfc00c0ec1e42eadd6f9368982292b3c9af768562b5653305d50cc473b99c099a490f3470cb29bef48a985301012b54901aded6e97d5f75e7537a758daec8c91448216192fc0e5363ea37f45cf29d63c609decc0bc61dfbf7688e8c336cc6eb919b1c87c8803eb8bf815117eb9b298e3dde314d17dc1bb12a52faedb633ecde2ca9ab712e75d10b452b1b73cfa8f8184eb68c726c7b408ac8fc3c70a9b575ff5be9198338a023c9d59f0b8247c15d97d84e173179337d49ab08cba7fba70dc66e42c6ee83e764d44b69a0137dc001cc1091b4d4914c51874aa7910c70e1c03470c3ff772c39efbc40298f469a4f966dd2de8d62350a841da98ec9eb55907bf884b9528c1", 0x1000}, {&(0x7f0000000180)}, {&(0x7f0000000380)="b17517f247e1175db37da276bf41f2fe71d28bbbaaadea3cbf7e5c9239e249eac16095c7345f5edc8b0bf66d9a7b704f3c6f4e2764ca5bde5056a267d09a21bc5ff7585f", 0x44}, {&(0x7f0000001480)="e0d537f7e53a283aa2ad2ca39a36264204605e7346145c07d66146038779d385652311362ea902f5b6181502ecbbb87f03f02f7b1b19ce27eee7f9d1b33294063ee5490a736d36979534045adae193d7d226df6ccb298e05ca0eff5fd9e7012a25bc7d6231911a37f9eafd3452135166c94e4f8aa94635b270b5a440642ad6f34c03eddd77684aa341f9519ab4c976a2b8b7ef37f5ac22a402978c8e1be8ae77e3afa726347bf8d659f28e9b0a5e7001867a6c17651873190d49c0e0da948632ece189cdcf0bf65280b1c346a7e80a720aef943a2dbb9178414a7449aa24909bf67050a08a71577f53", 0xe9}, {&(0x7f0000001580)="e5c066350e950c165cb535d195ae9557ffd891cefe2dac9940c624f8432c5e68fe277af9f6ee971b26921021702b3056cfd6d11eaa5b8bb5c77672add41d9ce0c4211d6379ad30c3d11df1ac7ae7", 0x4e}, {&(0x7f0000001600)="36bd656c72870472798f06cf46c2e55e4477161d58150af0a9acda17db032d31164130c492e2414c8a9f16ed8e45ccce9301b3f2a145804ebc892f4878a3afcd36f0347b9acc1146bbeb65604b18e20e46f471ab5eea4bee2bbafb5a7df4e11b38b5de69df7ea43fa23ce56b0d32e3ed10a63f0f173aa963d1d5e88f7d6ea37487e252759d0da3ebffc800d38c0430bc4178b3a0d520ff1a13c19053b88dc36368f126c053045953a2660a890958914cf130cf936833ee9c", 0xb8}, {&(0x7f00000016c0)="74bc7a41b5c3ee4f0b31e5b557374e22704a089c16882326f6bf6017e88c3d68aab94451afdf3ed8ad73900dda68840e9342b7eb007cc00ddd29b71deea9c05c6e34b26315247ff9ef84a39d5e4d8e40e9ea36508c82919bb5c214efd40c9b4c65c69f21a0972e57ec544ffa4418e44e88447f9d645859459123062956a89276783492cd45a11867d704d8732951b240475e7b906b85b6f425ab15e72a14e3da4c5a1dcc15a24d3356f4695eb925c3502f5ed8cfc2ae108704484b4acdcea707f36b6c0bcbef3bccfc8c7a6b3b7d08ced28db1c1b6c5eeaba0c528b7ea21b239b578cd685b9334c4b68db2986764b703", 0xf0}, {&(0x7f00000017c0)="418dd90aaaddb08bfa06754668a21597737afb69147f3b8f67699426cde20258859f25c574c978494acdca505c6b302ae3309dba0f08808c2f22dedfbe196dffeb39ba5249c841aebdc96ce0c658088b620f", 0x52}, {&(0x7f0000001840)="7d2eca418f46291333b68398247b598e8efc9b0053931e23ef7e4135281e5190c8615c55b5f905de79c32e9d481b9125458370768c553a547ab89a4e74357704a01dd8cd9fc8556693141456ee6205921407c8a9911bfe2c27708633c628eb2266adaf8860ba1ab2200e3f7c108db96b8b6bfe590865ffda2b328c0ae603dfd41ae78a97d46ce5959538383b9ecca32e6d420dc828c5ac5147753d7ef8a7fa69466dd66e73d6861285ce5adbaf5004df23a0d8a0c42260", 0xb7}], 0xa, &(0x7f0000001d40)=[@rights={{0x1c, 0x1, 0x1, [r3, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r2]}}, @rights={{0x10}}, @rights={{0x18, 0x1, 0x1, [r3, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, r3, r3, 0xffffffffffffffff, r3]}}, @cred={{0x1c, 0x1, 0x2, {r1}}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xffffffffffffffff, 0xffffffffffffffff}}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r3]}}], 0x120, 0x800}, {&(0x7f0000001e80)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000002040)=[{&(0x7f0000001f00)="f31fa24cc3cb855eb2336fa9ed691ccf67f05eb0396cd9850d39ab3af2db74f7c6a5b03ffe6be686179f397e56569989b0ce29c993dc054df2d3883cee5346ad54afca2a2fa1f2cc200c0453f0b47c02eb12b1077d3712ff179a0f21770c7d86d37031b47393001e179ad7264f5c12a7f63494b6d546abbedcaae052f4ae8bb4ac91626d265e6e9ec8c45bd6256bac3719a8ce563e40f42c80b748d702416409511424d92508d0ab47", 0xa9}, {&(0x7f0000001fc0)="3cdcec28be7fdc1da9b5e957c3cca89adfc7650568c1a173554d00df754efe62ef13976bca891d8a74057bf47cf1271239c5c2151c1cc7477f97e2049942dd87d6a54456eced2acd0a559eecafa8f311517357", 0x53}], 0x2, &(0x7f0000002440)=[@cred={{0x1c, 0x1, 0x2, {r1}}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {r1}}}, @rights={{0x1c, 0x1, 0x1, [r3, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r2]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x100, 0x4000000}, {&(0x7f0000002540)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000002600)=[{&(0x7f00000025c0)="4848ecf1bb0bcfd87330282ea9b4024e9e7428a568ffe54e1325c0d0856e7b1caf65c477264cc6e344ed37598b36c71f75f23b0d", 0x34}], 0x1, 0x0, 0x0, 0x22000001}], 0x3, 0x20000080) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, 0x0) perf_event_open$cgroup(&(0x7f0000005dc0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4387, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc1, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) recvfrom(r2, 0x0, 0x0, 0x40, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) write$eventfd(r0, &(0x7f0000000000)=0x4, 0x8) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r4, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) 03:11:32 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010a00004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:32 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000010040000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:32 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000050000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:32 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$FS_IOC_READ_VERITY_METADATA(r0, 0xc0286687, &(0x7f0000000040)={0x2, 0x9, 0x10, &(0x7f0000000000)=""/16}) fgetxattr(r0, &(0x7f0000000080)=@random={'btrfs.', '/dev/vcsa\x00'}, 0x0, 0x0) 03:11:32 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010b00004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1741.755912][T21517] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1741.771876][T21517] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.780036][T21517] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:32 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000002050000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:32 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010c00004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:32 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000040)=@known='trusted.overlay.nlink\x00', 0x0, 0x0) [ 1741.837989][T21528] loop5: detected capacity change from 0 to 16 [ 1741.851280][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1741.854912][T21528] attempt to access beyond end of device [ 1741.854912][T21528] loop5: rw=34817, want=184, limit=16 [ 1741.859582][T21524] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1741.908780][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.916838][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1741.938673][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1741.946822][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1741.994175][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.002326][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1742.014100][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.022213][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1742.041868][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.049865][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1742.061116][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.069147][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1742.094222][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.102248][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000cebea3eb [ 1742.117889][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.125985][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1742.139879][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.147937][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1742.160862][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.169004][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1742.180333][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.188409][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1742.200432][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.208451][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000c6b8909d [ 1742.227947][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.235969][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1742.247514][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.255525][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1742.266838][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.274985][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1742.303554][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.311596][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1742.328303][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.336108][T21556] validate_nla: 54 callbacks suppressed [ 1742.336120][T21556] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1742.336490][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1742.342385][T21556] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1742.353876][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.362372][T21556] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1742.369352][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1742.370976][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.377731][T21559] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1742.385535][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1742.386420][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.433826][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1742.445452][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.445519][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1742.446026][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.472783][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000cebea3eb [ 1742.484522][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.492737][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1742.504172][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.512287][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1742.523625][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.531662][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1742.542833][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.550976][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1742.570071][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.578095][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1742.589451][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.597424][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1742.608578][T21524] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.616605][T21524] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:33 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x550000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:33 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x6, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:33 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000060000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1742.656000][T21561] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1742.664414][T21561] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1742.679837][T21561] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.687833][T21561] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:33 executing program 1: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x12c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9db}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xff}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x32}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x464d4219}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7fffffff}]}, @TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7fff}]}, @TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x20}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xef11}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x200}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}]}, @TIPC_NLA_MEDIA={0x7c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}]}]}]}, 0x12c}}, 0x4004) fgetxattr(0xffffffffffffffff, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) 03:11:33 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010d00004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:33 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x581602, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:33 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000002060000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1742.718957][T21566] loop5: detected capacity change from 0 to 16 [ 1742.766544][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1742.775115][T21570] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1742.803353][T21583] netlink: 'syz-executor.0': attribute type 4 has an invalid length. 03:11:33 executing program 2: r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, 0x34}, 0x1c) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r1, &(0x7f0000000040)=@known='trusted.overlay.origin\x00', 0x0, 0x0) 03:11:33 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000004060000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:33 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010e00004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:33 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x7, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:33 executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f0000000500)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)={0x44, r1, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0x9}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x80000001}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_SECRET={0x14, 0x4, [0xffffffff, 0x9, 0x4, 0x4542]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x9}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000000}, 0x8040) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f00000000c0)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000580)={{{@in6=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private2}, 0x0, @in6=@initdev}}, &(0x7f0000000200)=0xe8) statx(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x4000, 0x1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r8 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) r9 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000000)={'syz', 0x2}, 0x0, 0x0, r8) keyctl$setperm(0x5, r9, 0x202002) keyctl$chown(0x4, r9, r6, r7) r10 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r10, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000380)=ANY=[@ANYRES64=r2, @ANYRES32=r2, @ANYBLOB="02000000", @ANYRES32=r3, @ANYBLOB="02000500", @ANYRES32=0xee00, @ANYBLOB="02bd010000a010a6570defce7f6b7cdad575eac5fb062dd5ed6b93221206981f5d1c132760", @ANYRES32=r4, @ANYBLOB="040001000000000008000000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=r7, @ANYBLOB="10000600000000002000010000000000"], 0x54, 0x0) r11 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r11, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r12 = request_key(&(0x7f00000006c0)='trusted\x00', &(0x7f0000000700)={'syz', 0x2}, &(0x7f0000000740)='@[(\x00', r8) add_key$keyring(&(0x7f0000000540), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r12) [ 1742.811854][T21583] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1742.820949][T21583] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1742.823509][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.829491][T21586] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1742.837044][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1742.887583][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.895757][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1742.944468][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.952712][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1742.964260][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1742.972264][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1742.992228][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.000261][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1743.011506][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.019519][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1743.055445][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.063484][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1743.077253][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.085269][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1743.097764][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.105798][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1743.117178][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.125709][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1743.138014][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.146145][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000cebea3eb [ 1743.166084][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.174142][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1743.185794][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.194036][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1743.205515][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.213500][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1743.245713][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.253773][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1743.261177][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.274130][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1743.280945][T21602] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1743.287238][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.293891][T21601] loop5: detected capacity change from 0 to 16 [ 1743.301421][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1743.302160][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.313318][T21602] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1743.318629][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1743.346067][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.354082][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1743.365196][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.365209][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1743.365986][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.392410][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1743.403659][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.411688][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1743.422973][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.431119][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1743.442311][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.450507][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1743.552458][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.560671][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1743.572224][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.580236][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1743.591509][T21570] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:34 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000011000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:34 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000070000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:34 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) clone3(&(0x7f0000000340)={0x12001000, &(0x7f00000000c0), &(0x7f0000000100)=0x0, &(0x7f0000000140), {0x21}, &(0x7f0000000180)=""/226, 0xe2, &(0x7f0000000280)=""/74, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x7, {r0}}, 0x58) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe1, 0x7, 0x4, 0x12, 0x0, 0x1000, 0x110, 0x3, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x80000000, 0x4, @perf_config_ext={0x100000001, 0x8}, 0x100, 0xfffffffffffffff9, 0x80000000, 0x5, 0x3, 0xcb93, 0x6, 0x0, 0x8, 0x0, 0x2}, r1, 0x5, r0, 0x1) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) r3 = getpgrp(r1) r4 = syz_open_dev$char_raw(&(0x7f00000003c0), 0x1, 0x300) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r5, 0x0) kcmp$KCMP_EPOLL_TFD(r2, r3, 0x7, r4, &(0x7f0000000400)={r5, r0, 0x7fff}) 03:11:34 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x570000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:34 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x8, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:34 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x40100, 0x0) open(&(0x7f0000000180)='./file0\x00', 0x501000, 0x62) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0xa7}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) 03:11:34 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000002070000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1743.599496][T21570] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:34 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:34 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x127903, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:34 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000011100004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:34 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x541e, &(0x7f0000000000)) [ 1743.677791][T21628] loop5: detected capacity change from 0 to 16 03:11:34 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000011200004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1743.816084][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1743.824576][T21631] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:34 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000080)='.', 0x0, 0x0, 0x0) mount(&(0x7f00000028c0)=ANY=[@ANYBLOB='/'], &(0x7f0000002900)='./file0\x00', 0x0, 0x5413, 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x20000, 0x0) mount(&(0x7f0000000080), &(0x7f0000000140)='.', 0x0, 0x5110, 0x0) rmdir(&(0x7f0000000040)='./file0\x00') fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:34 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000090000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:34 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xa, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1743.859640][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.867708][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1743.881696][T21645] loop5: detected capacity change from 0 to 16 [ 1743.902611][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.910905][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1743.958411][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.966525][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1743.977685][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1743.985789][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1744.006985][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.015161][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1744.026815][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.036051][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1744.064964][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.072968][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1744.087544][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.095589][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1744.108142][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.116133][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1744.127289][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.135759][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1744.149598][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.157860][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087224339 [ 1744.255928][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.264204][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000f02c92c6 [ 1744.285126][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.293196][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1744.304572][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.312693][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1744.323896][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.331911][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1744.367229][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.377062][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1744.402232][T21667] loop5: detected capacity change from 0 to 16 [ 1744.423561][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.431712][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1744.444728][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.453042][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1744.464465][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.472507][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1744.484334][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.492341][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1744.503757][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.511764][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1744.524490][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.532588][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1744.544097][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.552126][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1744.563569][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.571716][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1744.582905][T21631] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.590926][T21631] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:35 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x970000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:35 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000011600004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:35 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000a0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:35 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x14ef25bb40a33807, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:35 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xb, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:35 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000b0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:35 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x432181, 0x0) r1 = memfd_create(&(0x7f00000000c0)='\x00', 0x4) preadv2(r1, &(0x7f0000000100)=[{&(0x7f0000001940)=""/157, 0x9d}], 0x1, 0x0, 0x0, 0x10) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) preadv2(r0, &(0x7f00000003c0)=[{&(0x7f0000000140)=""/113, 0x71}, {&(0x7f00000001c0)=""/34, 0x22}, {&(0x7f0000000200)=""/97, 0x61}, {&(0x7f0000000280)=""/110, 0x6e}, {&(0x7f0000000300)=""/9, 0x9}, {&(0x7f0000000340)=""/97, 0x61}], 0x6, 0x10001, 0x1000, 0x8) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x2) [ 1744.754237][T21684] loop5: detected capacity change from 0 to 16 [ 1744.903261][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1744.911695][T21688] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1744.936080][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.944114][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1744.958747][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1744.966750][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1745.013839][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.021870][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1745.033010][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.041032][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1745.061959][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.070100][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1745.081449][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.089566][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1745.118422][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.126810][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1745.140722][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.148746][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1745.161189][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.169188][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1745.180585][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.188662][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1745.202189][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.210188][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1745.221496][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.229478][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1745.240800][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.249057][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1745.261168][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.269257][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1745.280502][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.288518][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1745.300719][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.308838][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1745.319956][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.327949][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1745.339512][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.347482][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1745.358612][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.366584][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1745.378397][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.386423][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1745.397652][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.405724][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1745.417088][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.425086][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1745.436336][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.444322][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1745.455560][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.463570][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1745.474775][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.482859][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1745.494305][T21688] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.502468][T21688] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1745.535675][T21706] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1745.543959][T21706] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1745.560148][T21706] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1745.568309][T21706] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:37 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x16, 0x0, 0x0) 03:11:37 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000011700004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:37 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xc, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:37 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x43da00, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) 03:11:37 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000c0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:37 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd04f00}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:37 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000d0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:37 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000011800004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1746.914908][T21715] loop5: detected capacity change from 0 to 16 03:11:37 executing program 1: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000005b00), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r1, &(0x7f00000073c0)={0x0, 0x0, &(0x7f0000007380)={&(0x7f0000000c00)={0x20, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_PRIVFLAGS_FLAGS={0xc, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8}]}]}, 0x20}}, 0x0) [ 1746.965151][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1746.973614][T21719] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1747.000023][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:37 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xd, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1747.008297][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1747.023566][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.031771][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 03:11:37 executing program 2: r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x103) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_MPATH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, r1, 0x1, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x0, 0x4a}}}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008000}, 0x20040800) sendmsg$NL80211_CMD_SET_POWER_SAVE(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x0, 0x100, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x840}, 0x400c000) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000000)="8977d9b0c724f21f403185f7f4c9", 0xe}, {&(0x7f0000000480)="018dd9cc8387f2299c5952b1de641b12afa6cf0a6d9cb0b66556d03abda49a931b764c80c75a111fe43ca32cd994e255542114e7670521808144a1b254d6d1fab74f91dcbfd6d8674f97f4cf228da8b479707b96ab1ad666ca03e438636d543f4188c966537293a98fdbe780427e93c03db9c4de617ab94992e2998046fa5501185b3d6365cb72a23f84a890bef760267030bda5d96c009ed5fc203ebd63e6d9e0d4136ed1e8e82542fafce2a0a5508860f94f29e6e8862fc430b1d9f7d15ae563ffdc2edf2b54799efa711928c6bc8be9eb8fd9c78ba5026ca045ebb78c18e88459323b12752267e70ce649efc47361c7fc70fe2c92267c0c3e1f08bf05e9c74afb7a1e61bbb72ca1af950d66158cea06369c508ec72e993aaa8d9f8366e9c5edb336e5b1489ab9ec3330c6d1ad4607b4dae92be7cf679aca7a3656a6959f11b25dd6b9030d7d1eb887ccd35eeb3dbadd0d141598356267f1aba3dc0debaf8992758c542bdd8f6cb871535e0d4e8bf2343324b78237458f464538f6e2257fb88098a409ed270682d3793f11a6f6a63be1646b103f46704e5eae7afeaf9e608890f9883a61b2c177b3d814d593569a9c9055ca34055d16c2b51125fce545f907179db7dca6e2fb587dd98a756fa61c45be1387d98f11062c8f482684570e54fa8d6ecb59130e8a679d1a629035affe612fa605329c5b7f91d22d1694e651c2ddc8c8b968c6505cedd2f4410eb3d814af86ea4e8151562e7b9a5b64d8edbd18ab5762fa9149937077fbccb936ff139bb1a6eac98179ca4a5d7f8b1447a235ca82d8a419a01f1eb42850f8c13582b51e16eb6325faac224eafa3b07c95b83cf53e47b6d9979d8b5ffec1445c814029fe5e2f627ff9f1db93f5c289ab1102a8e1a76981b3eb11945729cbe972118bc57bd4d9957f0c0f0ea788c6742b94e777f05e8b72412ae717aec0e6527d9d8c5852daf90c90345438188c7b97117843e895db2559bc1da69806a59d9c91687a790536c0db7b19565f2c8e3b1659d170c5a734a1fc77eda401b345b137d8e57cb834c52b4b14a5c614ad5f64bd5820f31b89de354314d61b8480c28bce10b63a37d923d717f2a0514d7f201d83ce39e00dbe78af62182dada5d0cc750b758c9fa9480196e63bc11cef96dc1841b770c318fb200ad925dbf69b32326a66d4040c1596917e49a24532459bc0677001813b6c7c6912668186b5634fef5e39bde3ab4527fb74e407685fcc2499a84ee3e0e82aeeec12664731418b947f29f34f7dbe49af968152ac9abb792e21a4023f18a72ad72e32af4f83198c2c601092488a7f2431cd6c9f88d95f4a7f9f6b892e8a883be1e54f8561bb11e4a5d1fdcef51ec6cfdaca0e49113f55ec284cead693748efa3186ce65e569405de1ff087b27ffc7170089990c0db633155012f32b368884dc41c4beb3857657888b60387993eb768eb81934ff781a33314736d3b1cbf5fc333ef1c18ff498834ca5fcfaa8f93ddffc537d8b363ba73eb3d25f159c90cc9af3a4d66f62404ed0a75733f67ad1ed20c1792bc60f0cc136762d045f81fbbb55cff35e5a38b169958f326db5a87fb459501c025360e8d3dce4dee94bc312aaa0c3f07e5d6e7550fccf4420656285e3f384db95d7dbe7c0fc8ce9140b3d3bf1b289cb883b9bf3ccb96fa17f1a6537c2cdc541c29157aafba5683cd0108c2800c67463798446362665be4840e4c80b6fb3879a1147cf7e5296a5d9675aa9e0f8c7a876434bc23522d3ac15f3365de81e390acf0a1b4e71f478e7e5a874330f0f77b8758bfcdb36f4cee1d5366470c9c2e0d6b73ad14fe7daae701406f849f1d6d30b69dd73f01d1fb33ad6e4d2651a466e026affcd3da84af8afdae11353796a028731f4790223dfa8f2f88397ee810c84ceb8cf22840707637d07bbf14f9ac508a9a0af6fdbe62746b738b8d36f3835f22ef2ca764cd802b615b050f183e15fc218c8cb656b8d9578adb053f5c04fb153e9c487649930923f92ac5c611cd349fcefa4e56efcb6dd5c2ebe547ae0414707491b4ad1dee02612552f08ef1be7732f4a2f532813dd605ff5589a0acd70d345ed70d85d8bae96f28958f18fc8a8f49aa173ac778f00c0dd2b24035baa279f42773ff896f75df09c02cdbaf675768f49113801b96ad18b81a547f53abcbe8e34a885e22b84b5963f4d8140c093fb51fdc2bc07bf320af9be534112d5ed68b7a5aed678268430720bdb86c1bb66d9a9409f883964b2a6e8a8daaee25c3b5340810311cb0086b957f4f804ebafcd7606e9c5937782a7fa5f8feede3f34843b1053c1c3d4aee7f519598ded0c6a9f643469311fb45a6ae55b4f5c12aaf9ebc1c15b15955301a013cc484b0cc5f0868ce9a4f7bf34e9a5e8013996c6a3d63209f40a751a6bf57bbeed538a331ed5759b9616faa87582834776b645c3e4b16ed040c34b4c83b410e7ba443ddea35d1c771197366cce47d3dcaa6636a9bd5414ab9b7975364a885e50fc4cc73f3040969bda280eff7a938ac3175f3d82e8202d3844558ad3ca59636677f4bd76588263bd850397220a2862aa1a55888d6508cc03aed997d403d63e85a19e98bb9bbbb5e62f601bf1223b5ca7031f21cfbd1ea38413b310a9a487d6a71fd08d8223166c4acaf9f78f0da6367b8738c92f695c789057dca0ff65c66a82a9cfa4f4d688255a0f1cbc9e37c5cc06a8542f72c07185e5d336d330ecf102b5dd0b2a3d26fe7255c4498d090e562580bbbe41cea4b3719311b85dc6e1b8f1ac4b7f4152b7f271f8129eab248946dba305a48c42068e0dab8ec509c51ec15b85fe8c6695b46893cd92588c17b2ee42a55f67f591d463adcdcbfa5bbdd06777651b3d13920bd9275da78b1e5ba5473f3cac2b0b1bba1082dda3234358d15974b0d56c8f46710307a1678e84defcde37c3c56c4c588025f2370273736f7f96d6f89da4ad791c2db1c09d504c444b93d7fe63ccc39b1645e25428a69f138819984c4305ecdbc5329433ce24eb12630f596228c41882bddfd5fb7f737ed9ba915ccdbad5ba0aeffd57ca8e1a99a7bf98d16340fd10b6c9c4f1ddffbdf335c5bbf63f1283dbf12d264a2e2672bf0d959f98eb5db7ba0c9a6251b3d6c75a580994107c74b4c32d7e722a777cd64cd44989b3503c395d80873c2d824bd36180d3713cf5fc929298ada5f34214bfe5be1f88a7b7d55b9f118f9f295529a7eee01952020eeeaa74bb815bf09672c2ba8fa7764f799fb203b6693de31b681da58a5121062c90365e2af030ac19f49dcbb8db54a1ea661a2f74f8e0d34764b2db07920dc5f108034bf0b69d9d03ce39df41b65272815ed34e6ace31d94c3a138697cdaae3d44b2a0cf3dcade1bc7d36a61aa712ddb0ac8188d5fcf36ad88859f8b56bc675d056e53a7005209d5afe169589011d3c762242632013bb0006a326ee9d7efd1d7201d9b9ac727faa213d1baf15702263f95e3352980fd1ab5ee1361b64956c46b7bcea3add2306ad1bacce5767ff401098b53ee32c89f70282541dd6b19bb30b5c1fe02e3409ad963d9f08729846a078e4492c045209328bc679e8f0d2af213d84c2ff99c50f01f5ed9eb6b1fc373ed2becd2f79196ff3ee014fcf899c4898239af8e005bba9db35f5b913412fd02cc40bd11c7965b8fedb3bdffe62ea7a36da9f77cdb0e4dc8bae66a0f1ca8df6d4b22459fd941f53636a68fe2af6b0a92eb88ebe71655944f58f80d7596f2cdf0ce690ff5745c7045e8b84e0c08f78731bc3b31c3bc8fad80394d2670d37f493a28a3a3ca33eba96f7579fcd7286141fd815da1bcfbc7f4dc47c9e56f06a393056fc803ec474d0f255d4d3c7dd2f372f096ea7ff4b0f18caa4057983cd497f73eece6e7bd46df7bdf9022c8e2ba712f95b0dca6d6f48d329e1c2909ceec596496c174c5a3096f8f9fb8a96fa923d38543cdf8a68241d32785460b13838f58572470d9b3c7c0c332760b5cbb5f90fbb9147ba4772905df88b996b6bd89ba3d325fbe95fd456618cf7d75d81c91b9415a10d22c19e63b5270bab40f0fac4bc817321eeaffb16de3f8405e0d80d8ed1e3dff9e3a1cfceb8167a44fadc2bb8b99e26f9a85740c128cf972811f79d7de3c14de53877c75e8136f7b1787f22ac796acc140629ce4cafc0daac4bf9854215ca015894923d8893f45834fb26d9acb43d67915974ad693a8bb12711b7b2dc8837e3132a48aa4bb8517dd31151096ef7d64a0cb91a2887200b0b357d8ed27b83b445e8bf2454b54572185a54004223b5a92f36d2300dd08f5c8e2ae765b68a8b449367de182513dc0977a41cc8b2a9a8ad5ab8363dbebbbd2d0423b242e8549d8bf1b8ffc986765a2f3ad47c61990c600efba1e0708556bde6f08e1bc088ae4d3f863157083f028b6b398e14fd893cb4dab519f16beda2b5bf599671b9d9ea976ca3b0a6b0ae94dbee4179f37f8fbe8b0821b2b7b0d149e7270a694549abb55402374994a138457dd1aacd1ecb0bdfadb4ed11f0099440c33934d3ec577e8596f4a1a7b47df77f308b4c8912ebea4fcf0c9eb47dee90d2a7e758c29cf950cf5c5d6c1f2017e613c27f8040a7e91022096743caa3299ff012bdaf0858f21199e66af10dc0d556f181f90e9f08e49b09701657d023fcc89370dc6a70fa2173c938d4814510eeffca50dd200ac83d5621c4bc9a90e71ddd9ae3ce5e4b77e4a5e1e1d7b6c95f3589ced387d1099d361031d3107ac0277a9ef36d17293c000b8d411e5a6a096c4ddfce29e6c8b21fb7ae4e4497ab9e7eb139d6fa8466c4250e90c775081694a45a900ad52e13ba47a9f2cf7009b4b14ce22dbac7034ff645a8789e7a1d50dcf929412e4173c076d41de54f887afd20a868f799d275a9084ee7e69ff44ec110d28e6d4968cee475c4e71c3b0609158f57af94d5bfb4912d62207abb32af0581564dbc48e9222b529fc8b20a6e8356147760d90fe259a792384566f4e3564c7c416a8821260a6e28887b9e8b03b37ef7378f2205b15ca55a988d26b1d4726feb6360845b88c8106596d3ce27069f66dababe573a55010431c27b1ade59a8cfc4d8926996eb61a2709c81529cb82ce46fe488bda9d9debd4e976fb193e519f839e57c30e46685717d3d432e42ea4e913d397a1e6f2ab811b017d6423a92d8ff8ab6a3c515df7228828cd7b83874cfc14cd262154d37d952c6fd2ffe8f5a62c2b37ad25887ea02d8cb58dfb4d9ad75be304c7e80fe153102dc365dcc338e0fac5529e86b83040c03bd05d8249b79aa67b37cc0312208c164562f9dd1b4a8aababc3f054370c3002e84acf1df06c45462bc322796a46ff38b709c4b7d070ca5cdebb5afa656e18d27c55d432514a8d0683d86d5ab4b5a5bde5b800700357fa55a33752e0e5291fee6b84683dcf6bd7227edd9f3332c43e08bad5fe6a32b8572bf86f1a0d11ab9d642ac1bd29d24459d7273ee78827c539b69fb62ae1a3906a939a5453a793fa2e87ec532327922aa3de91b36ad0fa0c1d1f56c9fb00c67176b93a22b39446f4d4bc3d9ee6ef806f62c68e7a8943ea8e43dbda06632b99a102b9920825b30e9d509e2effc0d61d2a0d422e92d19c6c69e143fd8d6e620d333187e2b7e2c4daae5dde42194e5ab10cb3aad2a0662bf65076ad029cc959f99a4903f0b0e0cca07511c7cac00226c42be5c5b069e6dc00b7312f7732c2490592314305be67355d818306a608e829b068109c57553ad4979cb8a9575ad44e31a626ae13accf31f131a3fd0a2429c42073f9534", 0x1000}], 0x2) r4 = openat$cgroup_devices(r0, &(0x7f0000000200)='devices.allow\x00', 0x2, 0x0) fgetxattr(r4, &(0x7f0000000280)=@random={'os2.', 'wlan1\x00'}, 0x0, 0x0) [ 1747.086882][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.095107][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1747.106836][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.114886][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1747.135177][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.143203][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1747.154901][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.162903][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1747.191604][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.199618][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1747.213521][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.221530][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1747.234146][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.242163][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1747.253317][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.261470][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1747.274713][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.282822][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1747.294091][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.302257][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1747.313824][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.321822][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:38 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = perf_event_open$cgroup(&(0x7f00000000c0)={0x5, 0x80, 0xff, 0x4, 0x20, 0x3, 0x0, 0x6, 0x2061, 0x6, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x6, 0x7, @perf_bp={&(0x7f0000000040), 0x6}, 0x401, 0xfffffffffffffffb, 0x401, 0x0, 0x401, 0x2, 0xe7, 0x0, 0xe64e, 0x0, 0x4}, r0, 0x0, 0xffffffffffffffff, 0xd) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r2, 0xf507, 0x0) ioctl$sock_netdev_private(r1, 0x8935, &(0x7f0000000000)) fcntl$getownex(r1, 0x10, &(0x7f0000000000)) 03:11:38 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000e0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1747.373250][T21742] validate_nla: 22 callbacks suppressed [ 1747.373264][T21742] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1747.373564][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.380167][T21742] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1747.387359][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1747.399308][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:38 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000011e00004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:38 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x30, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x1c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x15, 0x3, "7315b8ab4d2e80a04f73f22d7107c86535"}]}]}, 0x30}}, 0x0) 03:11:38 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xe, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1747.410107][T21742] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1747.414679][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1747.430006][T21744] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1747.431103][T21740] loop5: detected capacity change from 0 to 16 [ 1747.461925][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.470252][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1747.482168][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.490200][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1747.501853][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.509967][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1747.521218][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.529215][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1747.547733][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.555720][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1747.567521][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.575650][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1747.587269][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.595285][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1747.606628][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.614666][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1747.701145][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.709711][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1747.721168][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1747.729319][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1747.740521][T21719] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:38 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000f0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1747.748532][T21719] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1747.805274][T21765] loop5: detected capacity change from 0 to 16 [ 1747.810184][T21766] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1747.828333][T21766] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1747.853584][T21766] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1747.864588][T21775] netlink: 'syz-executor.0': attribute type 4 has an invalid length. 03:11:38 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10) fgetxattr(r0, &(0x7f0000000040)=@random={'system.', '@&+\x00'}, 0x0, 0x0) 03:11:38 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xf, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:38 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000004100000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:38 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000012500004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:38 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe0ffff}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:38 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x9, 0x0, &(0x7f0000000040)) 03:11:38 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000020100000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:38 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x13, &(0x7f00000006c0), 0x4) 03:11:38 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1800001, 0x12, r2, 0x3000) r3 = inotify_init() sendmsg$inet6(r1, &(0x7f0000000640)={&(0x7f0000000240)={0xa, 0x4e21, 0x2, @remote}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000280)="b04d120f3cdf35c49a788e7f16ed24a2bbc7ff92ed899298617f5dfbdacdbf6a1b95e8c913db9eca2d6d6cfac3f75d08b237299a2a9f980fcaf54a24982ecdef9e0251cc3ef5359d8c780e8571a727fd2054", 0x52}, {&(0x7f0000000300)="814bcd59c3c198a12e3a7749e6ca991d06988a4278433d838b8213831bc3afe416d7c827190cdcce4582c988cb61c7b437b4c909f91901c13bbc14bf9afc805503f9761df09a9ac85e33e5622077f42a0bfff388fa28bc7268e5ababc80853b20eb7458866fb165ab8b31cfa2e05e85d11c01ad5", 0x74}, {&(0x7f0000000480)="3cc096e35d6423f164e0dbc244e7e1d8c90910ca20800d58a5c018b7c29991cdee15c9edac5bf789df71f5fdf50751eaa630934af6eb0858834a1cc9844864e395214b2c8c1842fa55bd37c5b782c5e1d1a8c8519b4f8a777c293494400a949295759e95341dd6d367a8dbb72d14c9d51d582740023cefa9e1046528d9fb4a4d9108163ea30e1f43da2a95a095e6e18a75fce60822bc11ebe0089bedd1c1709a4cb235f79c3db6d6129520a22352195c7125495ce41198cd67754d1757104d97fc5622e7b0cb72fcccacf811f454627321bf98bc847482c16f25cb3661f31c309d2d", 0xe2}, {&(0x7f0000000380)="b701817e3da3ddbca945c55dd17d8c8534ab367efd8eb4599ee0f96e7711d81e1fcf8f5f88fdd8ba2d64231d32eeaa025733fda3a9c5904063470e5b24597ef8447f269fa7e89deece82cd9d6162b17e1bea0280632e421d6cb8b55cb86edda2b5f171f0e89d463b1b3a1b1b51f5d4d85c883e25120f2227b63fb0f95d9813feb0ed5f0ea193915b924150ddd22bf0ca0e", 0x91}], 0x4, &(0x7f00000005c0)=[@dontfrag={{0x14, 0x29, 0x3e, 0x1}}, @rthdrdstopts={{0x40, 0x29, 0x37, {0x74, 0x4, '\x00', [@ra={0x5, 0x2, 0x20}, @generic={0xa2, 0x21, "4fff7573a0fc6c2ebd4b670c1c518c8406cab2b0604d108f4ddc54cf2dfb940eab"}]}}}], 0x58}, 0x44050) openat$cgroup_ro(r0, &(0x7f00000000c0)='cpuset.memory_pressure\x00', 0x0, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) socket$packet(0x11, 0x3, 0x300) ppoll(&(0x7f0000000140)=[{r0}, {r3, 0xa600}, {0xffffffffffffffff, 0x96}, {r4, 0x80}, {r4, 0xcd2b3fc65c411b53}], 0x5, &(0x7f0000000180), &(0x7f00000001c0)={[0xfffffffffffffffc]}, 0x8) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r5, 0x89f0, &(0x7f0000000000)) close(r1) fgetxattr(r0, &(0x7f0000000080)=@known='security.selinux\x00', 0x0, 0x1f) ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000040)=""/45) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r5, &(0x7f0000000100)={0x1f}) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000200)={0x81, 0x1}) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x300000d, 0x11, r5, 0x35a93000) [ 1748.009448][T21795] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1748.029678][T21795] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1748.034344][T21799] loop5: detected capacity change from 0 to 16 [ 1748.055542][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1748.063867][T21800] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:38 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x10, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:38 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000014800004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:38 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000110000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:38 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0xc0045878, 0x0) 03:11:38 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x420001, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000300), r0) sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x3c, r2, 0x10, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x4001) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) fgetxattr(r3, &(0x7f0000000100)=@known='trusted.overlay.origin\x00', 0x0, 0x0) r4 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.stat\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000140)={{{@in=@dev, @in=@empty}}, {{@in=@empty}, 0x0, @in6=@private0}}, &(0x7f0000000240)=0xe8) lseek(r4, 0x20, 0x2) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x201000, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f00000000c0)={0x80000008}) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x400a00, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x8, 0x20010, r6, 0x1e9) [ 1748.105116][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.113221][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1748.131392][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.139523][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1748.192433][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.200629][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1748.211933][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.220059][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1748.240483][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.248482][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1748.259716][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.267865][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1748.302901][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.310920][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1748.325059][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.333084][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1748.346042][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.354128][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1748.365445][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.373747][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1748.385939][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.394077][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000d4e97393 [ 1748.413963][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.422174][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1748.433607][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.441807][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 03:11:39 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000014c00004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:39 executing program 2: pipe2(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, 0x0, 0x0, 0xffffffffffffff9c) [ 1748.453097][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.461105][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1748.507698][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.515930][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1748.540030][T21833] loop5: detected capacity change from 0 to 16 [ 1748.552743][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.560801][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1748.573784][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.581835][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1748.593134][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.601173][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1748.613570][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.621704][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1748.632985][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.641000][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1748.659742][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.667762][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1748.679149][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.687166][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1748.698535][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.706505][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1748.717720][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.725694][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1748.831924][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.840284][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1748.851703][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.860277][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1748.871717][T21800] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1748.879804][T21800] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:39 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf04a00}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:39 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000120000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:39 executing program 1: socket$inet6(0xa, 0x276da9b6a55915ab, 0x0) 03:11:39 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x11, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:39 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000016000004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:39 executing program 2: syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000002d00)=""/4096) [ 1748.925888][T21844] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1748.934201][T21844] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:39 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000140000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:39 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000016800004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:39 executing program 1: add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)={0x0, "46aa776b2de3c92499117505976f5dd10d718b594de5c03ba444828479daba33c8a80b9fc7db460b2480a7ddfac81b8095a3993319448aee781658219600de77"}, 0x48, 0xfffffffffffffffe) 03:11:39 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:39 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(r0, 0x8983, &(0x7f0000003fc0)) [ 1748.996426][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1749.004739][T21858] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1749.019619][T21862] loop5: detected capacity change from 0 to 16 [ 1749.056707][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.064787][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1749.086918][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.095086][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1749.142224][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.150310][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1749.162094][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.170112][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1749.189967][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.198080][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1749.209838][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.217939][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1749.253792][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.261942][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1749.275738][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.283913][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1749.296491][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.304684][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1749.316281][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.324319][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1749.335967][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.343990][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000012cf8bc [ 1749.426098][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.434169][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1749.445723][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.453745][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1749.465010][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:40 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000016c00004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1749.473099][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1749.510694][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.518911][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1749.523598][T21888] loop5: detected capacity change from 0 to 16 [ 1749.558583][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.566654][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1749.580573][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.588742][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1749.600258][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.608502][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1749.621010][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.629268][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1749.641030][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.649029][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1749.667763][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.675759][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1749.687450][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.695616][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1749.707194][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.715231][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1749.726352][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.734487][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:40 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ff1f}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:40 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000002160000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:40 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x13, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:40 executing program 1: r0 = socket$inet(0x2, 0x3, 0x5) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, 0x0, &(0x7f0000000100)) 03:11:40 executing program 2: syz_io_uring_setup(0x7db, &(0x7f0000000000), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000080), &(0x7f0000000100)) [ 1749.831197][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.840016][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1749.851612][T21858] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1749.859720][T21858] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 03:11:40 executing program 2: syz_mount_image$ext4(&(0x7f0000000000)='ext2\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x2040020, &(0x7f0000001840)) 03:11:40 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000017400004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:40 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000180000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:40 executing program 1: timerfd_create(0x5, 0x0) [ 1749.956506][T21915] loop5: detected capacity change from 0 to 16 [ 1749.984674][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1749.993050][T21912] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:40 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000002180000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:40 executing program 2: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x3, 0x1, 0x9, 0x40}]}) 03:11:40 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x14, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1750.020227][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.028285][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1750.043011][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.051106][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1750.104393][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.112883][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1750.124520][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.132683][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1750.152688][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.160724][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1750.171909][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.180105][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1750.216339][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.224994][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1750.239250][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.247622][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1750.260717][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.268805][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1750.279970][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.287956][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1750.300212][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.308206][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b4554a29 [ 1750.328184][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.336172][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1750.347260][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.355471][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1750.367151][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.375131][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1750.400796][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.408865][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1750.431241][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.439346][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1750.441828][T21941] loop5: detected capacity change from 0 to 16 [ 1750.453833][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.465052][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1750.476424][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.484422][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1750.496302][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.504315][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1750.515551][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.523619][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1750.535272][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.543378][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1750.554633][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.562767][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1750.574067][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.582074][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1750.593329][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.601482][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1750.691537][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.699554][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1750.710837][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.718969][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1750.730529][T21912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.738660][T21912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:41 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:41 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000017a00004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:41 executing program 1: openat$vcsa(0xffffffffffffff9c, 0x0, 0x0, 0x0) 03:11:41 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000190000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:41 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={0x0}, 0x1, 0x0, 0x700}, 0x0) 03:11:41 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x15, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1750.784935][T21949] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1750.793360][T21949] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1750.808989][T21949] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.817124][T21949] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:41 executing program 2: keyctl$KEYCTL_CAPABILITIES(0x1f, &(0x7f0000000040)=""/37, 0x7f) 03:11:41 executing program 1: mmap$IORING_OFF_CQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x30, 0xffffffffffffffff, 0x8000000) 03:11:41 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000001b0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:41 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001fc00004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:41 executing program 2: pipe2(&(0x7f00000017c0), 0x0) 03:11:41 executing program 1: fsmount(0xffffffffffffffff, 0x0, 0x41) [ 1750.871418][T21959] loop5: detected capacity change from 0 to 16 [ 1750.882222][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1750.890509][T21956] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1750.952405][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.960516][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1750.983439][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1750.992021][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1751.042259][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.050273][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1751.061768][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.070043][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1751.090086][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.098096][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1751.109335][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.117346][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1751.153993][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.162011][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1751.175998][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.184084][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1751.196819][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.205582][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1751.216795][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.224831][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1751.236877][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.245075][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000005889cbd8 [ 1751.265299][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.273434][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1751.284734][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.292827][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1751.306095][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.314219][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1751.351336][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.359384][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1751.373238][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.381273][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1751.393659][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.402614][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1751.414013][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.422166][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1751.433602][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.442099][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1751.453389][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.461569][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1751.479957][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.488183][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1751.499503][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.507670][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1751.520598][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.528649][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1751.543251][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.551836][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1751.563699][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.571789][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1751.583915][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.592177][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1751.603738][T21956] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.611732][T21956] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:42 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1004000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:42 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x16, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:42 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001fd00004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:42 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000200000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:42 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)) 03:11:42 executing program 1: r0 = syz_io_uring_setup(0x1428, &(0x7f0000000d80), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000700), &(0x7f0000000740)) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000780)=""/164, 0xa4}, {0x0}, {&(0x7f00000008c0)}], 0x3) 03:11:42 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000010200000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1751.652216][T21990] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1751.660508][T21990] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1751.676415][T21990] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.685296][T21990] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:42 executing program 2: socketpair(0x6, 0x0, 0x0, &(0x7f0000000180)) 03:11:42 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001fa01004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1751.744589][T21997] loop5: detected capacity change from 0 to 16 [ 1751.779290][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1751.787849][T22002] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:42 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000280)={0x3, &(0x7f0000000240)=[{0x20, 0x1, 0x0, 0x9}, {0x4, 0x0, 0x0, 0x7fff}, {0x6, 0x7, 0xf8, 0x80000000}]}, 0x10) 03:11:42 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000220000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:42 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001fe01004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1751.814938][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.823066][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1751.846727][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.855296][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1751.908112][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.916113][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1751.927421][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.935729][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1751.956144][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.964227][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1751.975537][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1751.983691][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1752.020026][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.028178][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1752.046083][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.054198][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1752.066479][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.074939][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1752.086434][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.094680][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1752.106679][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.114754][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000c792e560 [ 1752.134336][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.142457][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1752.153654][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.162380][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1752.173923][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.181948][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1752.209933][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.218062][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1752.234135][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.242191][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1752.254973][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.263003][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1752.274156][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.282378][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1752.293982][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.301999][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1752.313129][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.321174][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1752.340386][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.348710][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1752.360235][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.368335][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1752.379494][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.388024][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1752.399339][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.407512][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1752.425580][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.433616][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1752.444743][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.452743][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1752.463880][T22002] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.472008][T22002] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1752.512029][T22033] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 03:11:43 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:43 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000280)={0x3, &(0x7f0000000240)=[{0x20, 0x1, 0x0, 0x9}, {0x4, 0x22, 0x0, 0x7fff}, {0x6, 0x0, 0x0, 0x80000000}]}, 0x10) 03:11:43 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x17, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:43 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010402004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:43 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[], 0x4c}}, 0x0) 03:11:43 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000250000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:43 executing program 2: openat2(0xffffffffffffffff, 0x0, &(0x7f00000006c0)={0x0, 0x0, 0x4}, 0x18) 03:11:43 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$sock_timeval(r0, 0x1, 0x43, &(0x7f0000000000), &(0x7f0000000040)=0x10) 03:11:43 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000290000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1752.520429][T22033] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1752.536368][T22033] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.544561][T22033] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:43 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x18, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:43 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001f802004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1752.605006][T22042] loop5: detected capacity change from 0 to 16 [ 1752.611405][T22043] validate_nla: 46 callbacks suppressed [ 1752.611417][T22043] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1752.636798][T22043] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1752.647483][T22043] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1752.655598][T22052] netlink: 'syz-executor.0': attribute type 4 has an invalid length. 03:11:43 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000010000000000000001"], 0x28}}, 0x0) [ 1752.730114][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1752.738587][T22044] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:43 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x24, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_DEVKEY={0x10, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}]}]}, 0x24}}, 0x0) [ 1752.778160][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.786358][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1752.809156][T22063] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1752.822829][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.829492][T22063] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1752.830912][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1752.842012][T22063] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1752.858279][T22067] loop5: detected capacity change from 0 to 16 [ 1752.868370][T22069] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1752.900885][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.908929][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1752.920154][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.928299][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1752.947706][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.956272][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1752.967671][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1752.975759][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1753.012406][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.020907][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1753.034871][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.043021][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1753.055465][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.063459][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1753.074710][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.082715][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1753.094442][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.102603][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000008966dc96 [ 1753.183639][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.191907][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000f02c92c6 [ 1753.212690][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.220993][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1753.232424][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.240457][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1753.251713][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.259725][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1753.291839][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.299931][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1753.323009][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.331253][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1753.344706][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.352894][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1753.364227][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.372445][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1753.383970][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.391985][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1753.403247][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.411246][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1753.429516][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.437644][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1753.449498][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.457666][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1753.469600][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.477618][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe 03:11:44 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29f2000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:44 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000002290000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:44 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010003004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:44 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x19, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:44 executing program 1: clock_nanosleep(0x8, 0x1, &(0x7f00000000c0)={0x0, 0x3938700}, 0x0) 03:11:44 executing program 2: clock_gettime(0xd4583cf50000000b, 0x0) 03:11:44 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), r0) sendmsg$NLBL_UNLABEL_C_LIST(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="03002cbd7000fcdbdf2502000000140002002001000000000000000000000000000208000400ac141403d0"], 0x38}}, 0x0) 03:11:44 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000022c0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1753.488844][T22044] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.498362][T22044] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:44 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1a, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:44 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={0x0}}, 0x0) 03:11:44 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001f403004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1753.564496][T22097] loop5: detected capacity change from 0 to 16 [ 1753.570769][T22100] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1753.597131][T22100] netlink: 'syz-executor.0': attribute type 4 has an invalid length. 03:11:44 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, r1, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}]}, 0x44}}, 0x0) [ 1753.710810][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1753.719489][T22099] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1753.767750][T22118] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1753.774105][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.785224][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1753.798340][T22120] loop5: detected capacity change from 0 to 16 [ 1753.811551][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.819817][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1753.865412][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.873646][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1753.885779][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.894117][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1753.914364][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.923420][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1753.934842][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.943023][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1753.978370][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1753.986375][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1754.000351][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.008486][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1754.020902][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.029161][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1754.040330][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.048310][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1754.059609][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.067668][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b36b6cde [ 1754.153885][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.162075][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000f02c92c6 [ 1754.181886][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.190057][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1754.201962][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.210272][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1754.221661][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.229891][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1754.253052][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.261125][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1754.272837][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.280919][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1754.293317][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.301471][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1754.313265][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.321457][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1754.333292][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.342494][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1754.353745][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.362396][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1754.374529][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.383020][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1754.395252][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.403379][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1754.414591][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.422595][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1754.433939][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.441927][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:45 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:45 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000022d0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:45 executing program 1: pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x77359400}, &(0x7f0000000480)={&(0x7f0000000440)={[0x8]}, 0x8}) 03:11:45 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001f603004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:45 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1b, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:45 executing program 2: sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, 0x0, 0x0) [ 1754.453104][T22099] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.461144][T22099] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e 03:11:45 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1c, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:45 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010204004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:45 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000002e0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:45 executing program 2: syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, 0x0, 0x0) [ 1754.532721][T22149] loop5: detected capacity change from 0 to 16 03:11:45 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000320000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:45 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010005004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1754.674080][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1754.682498][T22155] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1754.707127][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.715164][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1754.742292][T22172] loop5: detected capacity change from 0 to 16 [ 1754.756225][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.764307][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1754.811241][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.819275][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1754.831051][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.839529][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1754.859547][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.867653][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1754.879408][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.887410][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1754.915969][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.924201][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1754.938633][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.946849][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1754.961469][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.969899][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1754.981435][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1754.989644][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1755.001278][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.009845][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ceb0ba32 [ 1755.114042][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.122409][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b36b6cde [ 1755.142944][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.151103][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1755.162385][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.170472][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1755.181744][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.189952][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1755.216086][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.224253][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1755.247071][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.255345][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1755.270856][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.279174][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1755.290691][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.298688][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1755.310123][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.318142][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1755.329904][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.337896][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1755.350015][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.358075][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1755.369430][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.377421][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1755.388542][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.396664][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1755.408610][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:46 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:46 executing program 2: r0 = socket(0x18, 0x800, 0x2) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={0x0, 0x42c}}, 0x0) 03:11:46 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), r0) sendmsg$NLBL_UNLABEL_C_LIST(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="03002cbd7000fcdbdf2502000000140002002001000000000000000000000000000208000400ac141403d0060b8b2195ec19d654bb08000400ac1e00013be03cc95210"], 0x38}}, 0x0) 03:11:46 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1d, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:46 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010006004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:46 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000003e0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:46 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={0x0}}, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000b40), 0xffffffffffffffff) [ 1755.416607][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1755.435555][T22155] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.444378][T22155] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e 03:11:46 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000003f0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:46 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010007004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1755.509208][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1755.517764][T22191] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:46 executing program 2: syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) 03:11:46 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1e, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1755.563033][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.571090][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1755.582778][T22202] loop5: detected capacity change from 0 to 16 03:11:46 executing program 1: syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000003c0), 0xffffffffffffffff) [ 1755.611648][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.619741][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1755.626333][T22212] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 1755.672710][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.681059][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1755.692809][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.700966][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1755.721590][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.729873][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1755.741548][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.749785][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1755.786099][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.794135][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1755.807931][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.815943][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1755.828775][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.836908][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1755.848066][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.856138][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1755.867829][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.875811][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000c792e560 [ 1755.973767][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1755.981806][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000f02c92c6 [ 1756.001966][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.010145][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1756.021505][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.029547][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1756.040704][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.048704][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1756.097843][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.105174][T22221] loop5: detected capacity change from 0 to 16 [ 1756.105898][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1756.145691][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.153780][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1756.166063][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.174112][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1756.185828][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.193811][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1756.205838][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.213877][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1756.225187][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.233295][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1756.252018][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.260033][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1756.271338][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.279340][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1756.290602][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.298594][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1756.309973][T22191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.317965][T22191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:47 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:47 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010009004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:47 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000400000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:47 executing program 2: syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 03:11:47 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x25, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:47 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFCONF(r0, 0x40049409, &(0x7f0000000140)=@buf) 03:11:47 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001000a004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:47 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000480000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:47 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x14}, 0x14}}, 0x0) 03:11:47 executing program 1: add_key$fscrypt_provisioning(&(0x7f0000000100), 0x0, &(0x7f00000007c0)=ANY=[], 0x29, 0xfffffffffffffffc) 03:11:47 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2a, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1756.522157][T22252] loop5: detected capacity change from 0 to 16 03:11:47 executing program 2: pselect6(0x40, &(0x7f0000000200), 0x0, &(0x7f0000000280)={0x8}, 0x0, 0x0) [ 1756.622939][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1756.631375][T22251] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1756.672551][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.680600][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1756.707841][T22273] loop5: detected capacity change from 0 to 16 [ 1756.717009][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.725017][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1756.771453][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.779638][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1756.791051][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.799323][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1756.819412][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.827515][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1756.839325][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.847380][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1756.883112][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.891154][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1756.905286][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.913296][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1756.926226][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.934264][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1756.945367][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.953376][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1756.964809][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1756.972808][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000cebea3eb [ 1757.063193][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.071468][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b4554a29 [ 1757.091652][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.099791][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1757.111505][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.119567][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1757.130838][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.138865][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1757.168666][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.176738][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1757.188907][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.197060][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1757.209176][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.217363][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1757.228611][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.236819][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1757.248430][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.256457][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1757.267590][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.275625][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1757.287435][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.295749][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1757.307306][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.315414][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1757.326594][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.334921][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1757.346490][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.354469][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:48 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:48 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001000b004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:48 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000004c0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:48 executing program 1: syz_io_uring_setup(0x4a65, &(0x7f0000000340), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) 03:11:48 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x48, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:48 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_ADD(r0, 0x0, 0x0) [ 1757.365804][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.373927][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1757.385432][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.393412][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1757.404628][T22251] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.412655][T22251] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:48 executing program 1: io_setup(0x8, &(0x7f0000000040)=0x0) io_destroy(r0) 03:11:48 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LISTALL(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x0, 0x205}, 0x14}}, 0x0) 03:11:48 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000003520000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:48 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001000c004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:48 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x4c, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1757.480781][T22293] loop5: detected capacity change from 0 to 16 [ 1757.623231][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1757.631699][T22296] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:48 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8901, &(0x7f0000000140)=@buf) [ 1757.678625][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.686669][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1757.705151][T22314] validate_nla: 38 callbacks suppressed [ 1757.705163][T22314] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1757.722906][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.726162][T22314] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1757.730954][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1757.741231][T22314] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1757.758844][T22315] loop5: detected capacity change from 0 to 16 [ 1757.767085][T22319] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1757.793866][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.801903][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1757.813087][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.821225][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1757.842461][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.850572][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1757.861836][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.869905][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1757.907014][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.915218][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1757.929471][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.937490][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1757.950118][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.958215][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1757.969532][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.977564][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1757.989042][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1757.997029][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000c6b8909d [ 1758.093348][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.101438][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ceb0ba32 [ 1758.121015][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.129183][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1758.140621][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.148748][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1758.160172][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.168414][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1758.196281][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.204315][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1758.216198][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.224327][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1758.236914][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.245141][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1758.256871][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.264854][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1758.276464][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.284455][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1758.295694][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.303727][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1758.315887][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.324245][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1758.336278][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.344337][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1758.356260][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.364234][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1758.375415][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.383470][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:49 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x60, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:49 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000590000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:49 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001000d004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:49 executing program 1: io_uring_setup(0x603f, &(0x7f0000000080)={0x0, 0x0, 0x4}) 03:11:49 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:49 executing program 2: io_setup(0x8000, &(0x7f00000014c0)) [ 1758.394660][T22296] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.402763][T22296] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e 03:11:49 executing program 2: syz_io_uring_setup(0x3bfb, &(0x7f0000000000), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, 0x0, 0x0) syz_io_uring_setup(0x18fb, &(0x7f0000000040), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 03:11:49 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000005a0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:49 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001000e004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:49 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0x43400) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) write$cgroup_subtree(r1, &(0x7f0000000700)=ANY=[], 0x32600) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000040), 0x43) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x100002, 0x0) write$cgroup_subtree(r2, 0x0, 0x20) perf_event_open(&(0x7f00000002c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r3, 0xc028660f, &(0x7f00000005c0)=0x3fffffffe) [ 1758.476863][T22339] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1758.492796][T22339] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1758.505232][T22340] loop5: detected capacity change from 0 to 16 [ 1758.512541][T22339] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1758.524329][T22345] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1758.530797][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1758.540823][T22337] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:49 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x68, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:49 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000025a0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:49 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000280), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000002c0)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8}]}, 0x1c}}, 0x0) 03:11:49 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010011004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1758.689937][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.698023][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1758.709470][T22357] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1758.717890][T22357] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1758.730013][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.738153][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1758.786133][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.794412][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1758.805653][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.813829][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1758.834449][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.842471][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1758.853786][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.862105][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1758.890518][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.898668][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1758.913174][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.921478][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1758.933918][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.942048][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1758.953541][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.961712][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1758.974004][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1758.982039][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b4554a29 [ 1759.002530][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.010758][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1759.021991][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.030103][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 03:11:49 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) 03:11:49 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000005b0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1759.041290][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.049404][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1759.079470][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.087617][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1759.110157][T22369] loop5: detected capacity change from 0 to 16 [ 1759.140165][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.148350][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1759.161394][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.169431][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1759.180902][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.189026][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1759.200607][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.208606][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1759.219751][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.227735][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1759.246371][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.254458][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1759.265657][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.273737][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1759.285014][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.293084][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1759.304302][T22337] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.312389][T22337] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:50 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:50 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010012004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:50 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x6c, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:50 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x19) 03:11:50 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) close(r0) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24800000d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='cpuacct.usage_percpu\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x4030582a, &(0x7f0000000040)) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_type(r0, &(0x7f0000000140), 0x12000005f) 03:11:50 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000005c0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:50 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000005d0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:50 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010016004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1759.498287][T22403] loop5: detected capacity change from 0 to 16 03:11:50 executing program 1: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x80, 0xdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) 03:11:50 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000600000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1759.539436][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1759.547813][T22401] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1759.576885][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:50 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x74, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:50 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010017004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1759.584953][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1759.599930][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.607974][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1759.659964][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.668009][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1759.679256][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.687287][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1759.708113][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.716164][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1759.727821][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.735836][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1759.775598][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.783840][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1759.798509][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.806531][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1759.819674][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.827693][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1759.839676][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.847695][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1759.860171][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.868178][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ee87965d [ 1759.889610][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.897760][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1759.909874][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.917894][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1759.929452][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.937479][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1759.959822][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.967986][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1759.990884][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1759.998968][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1760.012010][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.020066][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1760.031249][T22434] loop5: detected capacity change from 0 to 16 [ 1760.039781][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.047914][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1760.060369][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.068474][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1760.080634][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.088647][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1760.101476][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.109502][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1760.128341][T22434] loop5: detected capacity change from 0 to 16 [ 1760.131780][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.142568][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1760.153817][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.161876][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1760.173089][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.181106][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1760.299733][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.308117][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1760.319942][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.328208][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1760.340317][T22401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:51 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:51 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000680000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:51 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010018004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:51 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) close(r0) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24800000d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='cpuacct.usage_percpu\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x4030582a, &(0x7f0000000040)) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_type(r0, &(0x7f0000000140), 0x12000005f) 03:11:51 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x7a, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:51 executing program 1: syz_io_uring_setup(0x0, &(0x7f0000000000), &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) [ 1760.348413][T22401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:51 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5409, &(0x7f0000000040)) 03:11:51 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000006c0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:51 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001001e004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1760.439978][T22455] loop5: detected capacity change from 0 to 16 03:11:51 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xb0, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:51 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001001f004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:51 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000002720000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1760.549294][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1760.557632][T22461] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1760.575440][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.583449][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1760.598587][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.606624][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1760.660384][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.668441][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1760.680175][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.688222][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1760.709732][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.717764][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1760.729810][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.737854][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1760.779282][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.787323][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1760.802202][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.810260][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1760.823349][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.831380][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1760.843572][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.851678][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1760.865892][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.873887][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1760.885847][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.893828][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1760.905474][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.913452][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1760.932290][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1760.940438][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1760.954285][T22485] loop5: detected capacity change from 0 to 16 [ 1761.001403][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.009652][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1761.022793][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.030842][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1761.043109][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.051226][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1761.062667][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.070791][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1761.081954][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.090079][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1761.102141][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.110154][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1761.121436][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.129472][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1761.140818][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.148845][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1761.160019][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.168785][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1761.268926][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.277125][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1761.288616][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.297117][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1761.308823][T22461] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:52 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:52 executing program 1: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 03:11:52 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010020004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:52 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000002730000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:52 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xef, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:52 executing program 2: perf_event_open(&(0x7f00000004c0)={0x2, 0x80, 0xdc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fork() waitid(0x1, 0x0, &(0x7f0000000140), 0x0, 0x0) [ 1761.317023][T22461] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:52 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000740000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:52 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010025004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:52 executing program 2: select(0x40, &(0x7f0000000000), &(0x7f0000000040), 0x0, &(0x7f00000000c0)) 03:11:52 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xf2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:52 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000007a0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:52 executing program 1: select(0x40, &(0x7f0000000000), 0x0, &(0x7f0000000080)={0x5}, &(0x7f00000000c0)) [ 1761.424123][T22508] loop5: detected capacity change from 0 to 16 [ 1761.539590][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1761.548123][T22511] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1761.591708][T22528] loop5: detected capacity change from 0 to 16 [ 1761.603131][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.611170][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1761.641490][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.649713][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1761.697739][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.705862][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1761.716970][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.724990][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1761.743925][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.752130][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1761.763435][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.771431][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1761.807711][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.815845][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1761.829194][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.837401][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1761.849767][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.857763][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1761.869042][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.877045][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1761.888543][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1761.896657][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000000ace092b [ 1761.992532][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.000696][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000651335fb [ 1762.020591][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.028689][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1762.040552][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.048566][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1762.059777][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.067816][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1762.088227][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.096293][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1762.109647][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.117728][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1762.129794][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.138338][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1762.149604][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.157727][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1762.169507][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.177508][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1762.188661][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.196690][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1762.208841][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.216852][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1762.228167][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:53 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa020000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:53 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000018c0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:53 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001003f004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x540b, &(0x7f0000000040)) 03:11:53 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xf7, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:53 executing program 1: openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x2081, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000001c40), 0x0, 0x0) [ 1762.236183][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1762.247836][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.255958][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1762.267424][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.275533][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:53 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000018d0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:53 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_GET_FEATURE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x2}, 0xc, &(0x7f0000000100)={0x0}}, 0x0) 03:11:53 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010048004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1762.286787][T22511] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.294910][T22511] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e 03:11:53 executing program 1: socket(0x15, 0x5, 0x8) 03:11:53 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xf8, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1762.373189][T22556] loop5: detected capacity change from 0 to 16 03:11:53 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001004c004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1762.498947][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1762.507416][T22552] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1762.554419][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.562507][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1762.593583][T22577] loop5: detected capacity change from 0 to 16 [ 1762.611266][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.619351][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1762.666850][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.674987][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1762.686591][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.694732][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1762.714453][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.722740][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1762.734390][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.742390][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1762.776369][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.784386][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1762.798346][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.806367][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1762.818838][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.827116][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1762.838642][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.846635][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1762.858350][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.866401][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000057de42ba [ 1762.962275][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.970602][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000651335fb [ 1762.990883][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1762.999107][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1763.010798][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.018898][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1763.030355][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.038356][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1763.068122][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.075790][T22588] validate_nla: 46 callbacks suppressed [ 1763.075803][T22588] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1763.076345][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1763.082011][T22588] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1763.096674][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.105054][T22588] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1763.109209][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1763.118138][T22590] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1763.143725][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.152496][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1763.163751][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.171773][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1763.183652][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.191769][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1763.203657][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:54 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:54 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000ad0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:54 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_GET_FEATURE(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x10}, 0xffffffffffffffd8}}, 0x0) 03:11:54 executing program 1: shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000100)=""/211) 03:11:54 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x204, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:54 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010060004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1763.211780][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1763.223559][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.231750][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1763.243052][T22552] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.251081][T22552] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 03:11:54 executing program 2: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0xffc99a3b, 0x0) 03:11:54 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000001d20000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:54 executing program 1: socketpair(0x11, 0x0, 0x0, &(0x7f0000005540)) 03:11:54 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010068004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1763.303721][T22599] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1763.322299][T22599] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1763.330747][T22601] loop5: detected capacity change from 0 to 16 [ 1763.351450][T22599] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1763.360159][T22608] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1763.391467][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 03:11:54 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000001d30000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1763.399940][T22603] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:54 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x300, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1763.446097][T22618] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1763.447311][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.458005][T22618] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1763.462282][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1763.485797][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.493810][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1763.543841][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.551859][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1763.563596][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.572241][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1763.592294][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.600494][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1763.611704][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.619708][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1763.655159][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.663154][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1763.677306][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.685352][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1763.697966][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.705964][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1763.717112][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.725125][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1763.738101][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.746111][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1763.757533][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.765523][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1763.776641][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.784900][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1763.816821][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.824858][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1763.845031][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.846548][T22631] loop5: detected capacity change from 0 to 16 [ 1763.853065][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1763.871835][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.879883][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1763.891438][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.899631][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1763.910970][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.918963][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1763.930490][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.938517][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1763.950158][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.958453][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1763.969868][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.977859][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1763.989158][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1763.997159][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1764.008323][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.016367][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1764.118292][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.126356][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1764.137796][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.145817][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1764.156952][T22603] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.164995][T22603] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1764.202936][T22636] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 03:11:54 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:54 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pidfd_getfd(r0, 0xffffffffffffffff, 0x0) 03:11:54 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001006c004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:54 executing program 1: openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x46280, 0x0) 03:11:54 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000001d60000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:54 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x402, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:55 executing program 2: socket(0x10, 0x0, 0x7ff) 03:11:55 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000001e60000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:55 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010074004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1764.211331][T22636] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1764.226964][T22636] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.235102][T22636] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1764.302574][T22648] loop5: detected capacity change from 0 to 16 [ 1764.310299][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1764.318615][T22649] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:55 executing program 2: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000003c0), 0x200040, 0x0) read$rfkill(r0, 0x0, 0x0) 03:11:55 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000001e90000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:55 executing program 1: syz_open_dev$vcsu(&(0x7f00000001c0), 0x0, 0x299803) [ 1764.365524][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.373863][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1764.388686][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.396956][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1764.461518][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.469713][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1764.480853][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.489269][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1764.509532][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.517539][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1764.529030][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.537018][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1764.565796][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.573913][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1764.588081][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.596101][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1764.608738][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.616736][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1764.628263][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.636387][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1764.648484][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.656673][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000651335fb [ 1764.676563][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.684587][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1764.695701][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.703721][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1764.714832][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.723314][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1764.758075][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.766113][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1764.779157][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.787259][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1764.799473][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.807687][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1764.819073][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.827063][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1764.838469][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.846594][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1764.857832][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.865817][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1764.884597][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.892598][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1764.903869][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.911879][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1764.923075][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.931064][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1764.942246][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.950256][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1764.968327][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.976485][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1764.987855][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1764.995989][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1765.007282][T22649] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.015352][T22649] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:55 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:55 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x406, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:55 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001007a004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:55 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x98, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @val={0xc}}}, [@NL80211_ATTR_HT_CAPABILITY_MASK={0x1e}, @NL80211_ATTR_IE={0x26, 0x2a, [@chsw_timing={0x68, 0x4}, @ht={0x2d, 0x1a}]}, @NL80211_ATTR_FILS_NONCES={0x24}, @NL80211_ATTR_FILS_KEK={0x4}]}, 0x98}}, 0x0) 03:11:55 executing program 2: pselect6(0x40, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000140)={[0x9]}, 0x8}) 03:11:55 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000c0ed0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:55 executing program 2: msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000000)={{0x2, 0xee01, 0x0, 0x0, 0xee00}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0xffffffffffffffff}) [ 1765.063365][T22678] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1765.071705][T22678] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1765.087211][T22678] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.095260][T22678] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:55 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000103f4004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:55 executing program 2: r0 = syz_open_dev$vcsu(&(0x7f00000001c0), 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0) 03:11:55 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000001f80000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:55 executing program 1: pselect6(0x40, &(0x7f0000000040), &(0x7f0000000080)={0x7}, &(0x7f00000000c0), 0x0, 0x0) [ 1765.152236][T22684] loop5: detected capacity change from 0 to 16 [ 1765.173464][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1765.181777][T22691] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1765.222452][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.230500][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1765.244867][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.253023][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1765.299077][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.307103][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1765.318373][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.326366][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f 03:11:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x500, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1765.345963][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.353939][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1765.365098][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.373062][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1765.410198][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.418222][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1765.431967][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.439991][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1765.452473][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.460471][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1765.471584][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.479565][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1765.492743][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.500883][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1765.512088][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.520071][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1765.531214][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.539213][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1765.585092][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.593101][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1765.611802][T22710] loop5: detected capacity change from 0 to 16 [ 1765.615074][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.626038][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1765.639798][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.647852][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1765.659100][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.667259][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1765.678950][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.686939][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1765.698194][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.706179][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1765.724665][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.733112][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1765.744616][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.752591][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1765.763744][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.771751][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1765.782915][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.790903][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1765.907986][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.916255][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1765.927703][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.935925][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1765.947407][T22691] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1765.955636][T22691] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:56 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:56 executing program 2: r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) pidfd_send_signal(r0, 0x0, 0x0, 0x0) 03:11:56 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000103f6004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:56 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000001f90000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:56 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000002c0)) 03:11:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x600, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:56 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000102f8004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:56 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000001fa0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1766.004663][T22724] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1766.013179][T22724] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1766.028921][T22724] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.036943][T22724] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:11:56 executing program 2: syz_open_procfs$userns(0x0, &(0x7f0000000040)) 03:11:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x604, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:56 executing program 1: r0 = syz_io_uring_setup(0x75cc, &(0x7f0000000200), &(0x7f00003b2000/0x1000)=nil, &(0x7f00007e6000/0x1000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r3, 0x0, &(0x7f0000000100)=""/53, 0x35}, 0x0) io_uring_enter(r0, 0x4ab0, 0x0, 0x0, 0x0, 0x0) shutdown(r4, 0x1) 03:11:56 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000101fa004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1766.101610][T22732] loop5: detected capacity change from 0 to 16 [ 1766.258869][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1766.267292][T22738] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1766.312301][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.320489][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1766.340116][T22765] loop5: detected capacity change from 0 to 16 [ 1766.351714][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.359772][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1766.407648][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.415933][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1766.427389][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.435571][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1766.455811][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.463807][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1766.474942][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.483796][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1766.520508][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.528519][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1766.542303][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.550396][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1766.563290][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.571290][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1766.582513][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.590541][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1766.602243][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.610295][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000001696a5d0 [ 1766.702494][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.710740][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1766.722026][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.730148][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1766.741409][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.749592][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1766.770129][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.778258][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1766.789669][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.797693][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1766.810359][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.818359][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1766.829705][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.837813][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1766.849375][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.857440][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1766.868573][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.876641][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1766.888377][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.896369][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1766.907805][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.915876][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1766.927217][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.935569][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1766.947085][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.955082][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1766.966394][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1766.974371][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1766.985473][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:57 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:57 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000001fb0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:57 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1d, 0x0, 0x7f}) 03:11:57 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100fc004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:57 executing program 2: mount_setattr(0xffffffffffffff9c, 0x0, 0x0, &(0x7f00000000c0)={0x100085}, 0x20) 03:11:57 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x700, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:57 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000fff0000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1766.993647][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1767.004779][T22738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.012760][T22738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:57 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100fd004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:57 executing program 2: mq_getsetattr(0xffffffffffffffff, &(0x7f0000000000)={0x200}, &(0x7f0000000040)) 03:11:57 executing program 1: r0 = socket(0x2, 0xa, 0x0) ioctl$sock_SIOCDELRT(r0, 0x8904, &(0x7f00000001c0)={0x0, @l2tp={0x2, 0x0, @loopback}, @xdp, @l2tp={0x2, 0x0, @broadcast}}) 03:11:57 executing program 2: r0 = socket(0x2, 0xa, 0x0) ioctl$sock_SIOCDELRT(r0, 0x8955, 0x0) 03:11:57 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000ffff0300000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1767.093892][T22788] loop5: detected capacity change from 0 to 16 [ 1767.258988][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1767.267403][T22785] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1767.304736][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.312760][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1767.330200][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.338234][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1767.390547][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.398778][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1767.410359][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.418466][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1767.439027][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.447252][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1767.458498][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.466493][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1767.502324][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.515114][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1767.528837][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.536951][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1767.549698][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.557726][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1767.568957][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.576937][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1767.589032][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.597093][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000001696a5d0 [ 1767.616475][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.624468][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1767.635909][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.644123][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1767.655580][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.663628][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1767.683723][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.691724][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1767.703035][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.711028][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1767.723297][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.731361][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1767.742543][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.750521][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1767.761866][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.769847][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1767.780964][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.788943][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1767.801126][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.809182][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1767.820777][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.828781][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1767.839944][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.847945][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1767.859068][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.867147][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1767.879260][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.887294][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e 03:11:58 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:58 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x900, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:58 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000101fe004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:58 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000400000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:58 executing program 1: clone3(&(0x7f00000011c0)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(&(0x7f0000003c00)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(&(0x7f0000001480)={0x4020000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000001440)=[0x0], 0x1}, 0x58) 03:11:58 executing program 2: r0 = socket(0x2, 0xa, 0x0) ioctl$sock_SIOCDELRT(r0, 0x894c, 0x0) [ 1767.898520][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.906510][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1767.917740][T22785] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1767.925747][T22785] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:11:58 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000ffff1f00000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1767.956008][T22817] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1767.964425][T22817] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:11:58 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCDELRT(r0, 0x890c, &(0x7f0000001280)={0x0, @in={0x2, 0x0, @local}, @l2={0x1f, 0x0, @none}, @phonet}) 03:11:58 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000004000000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1768.022509][T22824] loop5: detected capacity change from 0 to 16 [ 1768.056186][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 03:11:58 executing program 2: r0 = socket(0x2, 0xa, 0x0) ioctl$sock_SIOCDELRT(r0, 0x8940, 0x0) [ 1768.064541][T22828] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1768.087432][T22833] validate_nla: 38 callbacks suppressed [ 1768.087444][T22833] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1768.106146][T22833] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1768.107876][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:11:58 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100ff004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:58 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xa00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1768.122305][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1768.122417][T22833] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1768.141582][T22841] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1768.154902][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.163033][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1768.216876][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.225021][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1768.237434][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.245498][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1768.266268][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.274766][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1768.286049][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.294075][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1768.323237][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.331292][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1768.345777][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.353762][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1768.366218][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.374305][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1768.385455][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.393414][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1768.404940][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.412971][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000d03896d3 [ 1768.523360][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.531487][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1768.542695][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.550800][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1768.562448][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.570458][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1768.602664][T22851] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1768.606323][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.613146][T22851] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1768.618763][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1768.630858][T22851] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1768.640719][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.650352][T22855] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1768.653984][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1768.675021][T22857] loop5: detected capacity change from 0 to 16 [ 1768.680309][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.689578][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1768.700783][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.709662][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1768.721442][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.729454][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1768.740687][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.748708][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1768.760466][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.768552][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1768.780711][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.788695][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1768.799893][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.807874][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1768.819051][T22828] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1768.827026][T22828] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:11:59 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:11:59 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000001000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:59 executing program 1: r0 = socket(0x2, 0xa, 0x0) ioctl$sock_SIOCDELRT(r0, 0x8954, 0x0) 03:11:59 executing program 2: clone3(0x0, 0x0) clone3(&(0x7f0000001480)={0x4020000, &(0x7f0000001240), &(0x7f0000001280), &(0x7f00000012c0), {0x38}, &(0x7f0000001500)=""/33, 0x21, &(0x7f0000001340)=""/215, &(0x7f0000001440)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8}, 0x58) 03:11:59 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000004600000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:11:59 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xb00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:11:59 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000002000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:59 executing program 1: clone3(&(0x7f0000001480)={0x4020000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000001440)=[0x0], 0x1}, 0x58) 03:11:59 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010002004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1768.986638][T22877] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1768.997115][T22877] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1769.007479][T22880] loop5: detected capacity change from 0 to 16 [ 1769.025480][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 03:11:59 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000402000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:11:59 executing program 2: r0 = socket(0x2, 0xa, 0x0) ioctl$sock_SIOCDELRT(r0, 0x80108906, 0x0) 03:11:59 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010003004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1769.033856][T22871] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1769.064902][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.072966][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1769.096905][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.105085][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1769.151744][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.159768][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1769.171562][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.179707][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1769.199873][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.208059][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1769.219258][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.227402][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1769.257820][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.265833][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1769.279722][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.287862][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1769.300514][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.308518][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1769.319721][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.328001][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1769.340473][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.348497][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000a5c9c915 [ 1769.368153][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.376260][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1769.387500][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.395502][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1769.406671][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.414673][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1769.450100][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.458158][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1769.474181][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.482363][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1769.495008][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.502983][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1769.514274][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.522251][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1769.533575][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.541550][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1769.552672][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.560916][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1769.574146][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.582110][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1769.593384][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.602227][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1769.613473][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.621444][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1769.632653][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.640750][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1769.659080][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.667094][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1769.678200][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.686273][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1769.697505][T22871] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.705505][T22871] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:00 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:00 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xc00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:00 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000003000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x5, 0x0, &(0x7f0000000f00)) 03:12:00 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010004004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:00 executing program 1: clone3(&(0x7f0000001480)={0x4020000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000001440)=[0x0], 0x1}, 0x58) 03:12:00 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000004000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCDELRT(r0, 0x890c, &(0x7f0000000040)={0x0, @in={0x2, 0x0, @rand_addr=0x64010102}, @ethernet={0x0, @random="104a1f56da9b"}, @vsock={0x28, 0x0, 0x0, @local}, 0x3ff, 0x0, 0x0, 0x0, 0x8}) 03:12:00 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010005004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1769.776275][T22908] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1769.784586][T22908] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:12:00 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ifreq(r0, 0x8948, &(0x7f0000000140)={'caif0\x00', @ifru_map}) 03:12:00 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000204000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:00 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010006004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1769.835001][T22917] loop5: detected capacity change from 0 to 16 [ 1769.857794][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1769.866266][T22919] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1769.899081][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.907135][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1769.934763][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.942901][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1769.990440][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1769.998610][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1770.009759][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.017762][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1770.037458][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.045454][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1770.056688][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.064691][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1770.108605][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.116626][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1770.130439][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.138539][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1770.150712][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.158706][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1770.170607][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.178789][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1770.190971][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.198977][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000bc0a380a [ 1770.218727][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.227335][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1770.238581][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.246582][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1770.257819][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.265806][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1770.291699][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.299946][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1770.322683][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.330839][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1770.345068][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.353303][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1770.364598][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.372596][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1770.383984][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.391965][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1770.403357][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.411471][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1770.423269][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.431272][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1770.442560][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.450553][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1770.461794][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.469899][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1770.481143][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.489131][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1770.506874][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.514946][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1770.526056][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.534041][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1770.545283][T22919] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.553368][T22919] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:01 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:01 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xd00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:01 executing program 1: clone3(&(0x7f0000001480)={0x4020000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000001440)=[0x0], 0x1}, 0x58) 03:12:01 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010007004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:01 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000005000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:01 executing program 2: mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x4131, 0xffffffffffffffff, 0x10000000) 03:12:01 executing program 2: syz_mount_image$iso9660(&(0x7f0000000040), &(0x7f0000006080)='./file0\x00', 0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@sbsector}, {@map_normal}, {@hide}]}) 03:12:01 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010008004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:01 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000205000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:01 executing program 2: prctl$PR_SET_NAME(0xf, &(0x7f0000000080)='fscrypt-provisioning\x00') [ 1770.598977][T22952] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1770.607263][T22952] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1770.622501][T22952] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.630726][T22952] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1770.678651][T22957] loop5: detected capacity change from 0 to 16 [ 1770.712242][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 03:12:01 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000006000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:01 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010009004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1770.720738][T22965] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1770.760295][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.768367][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1770.792446][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.800511][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1770.846283][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.854483][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1770.865605][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.873636][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1770.893666][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.901669][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1770.912946][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.920951][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1770.964875][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.972931][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1770.986698][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1770.994730][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1771.007298][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.015326][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1771.026495][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.034581][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1771.046961][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.056510][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000083ab126b [ 1771.076413][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.084403][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1771.095577][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.103574][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1771.114701][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.122778][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1771.148122][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.156182][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1771.174857][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.182903][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1771.195491][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.204134][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1771.215444][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.223492][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1771.235160][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.243321][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1771.255120][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.263108][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1771.275009][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.283133][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1771.294672][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.302745][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1771.314267][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.322260][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1771.333433][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.341405][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1771.359752][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.367760][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1771.379056][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.387457][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1771.398837][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.406817][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:02 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18030000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:02 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={0x0, 0x20000454}}, 0x0) 03:12:02 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xe00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:02 executing program 1: clone3(&(0x7f0000001480)={0x4020000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000001440)=[0x0], 0x1}, 0x58) 03:12:02 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000206000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:02 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001000a004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:02 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000406000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:02 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001000b004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:02 executing program 2: keyctl$restrict_keyring(0x11, 0x0, 0x0, 0x0) [ 1771.444882][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1771.453977][T22965] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1771.469960][T22965] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.477970][T22965] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:12:02 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xf00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:02 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000007000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1771.527286][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1771.535677][T22999] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1771.548288][T23003] loop5: detected capacity change from 0 to 16 [ 1771.564366][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.572403][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1771.595885][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.604029][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1771.651978][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.660118][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1771.673359][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.681667][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1771.701945][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.710059][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1771.721309][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.729541][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1771.759778][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.767783][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1771.781430][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.789425][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1771.802193][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.810189][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1771.821456][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.829438][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1771.841050][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.849049][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000d281fb95 [ 1771.931002][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.939259][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000bc0a380a [ 1771.959480][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.967763][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e 03:12:02 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="cc000000", @ANYRES16=r1, @ANYBLOB="0300000000000000000005000000050003"], 0xcc}}, 0x0) [ 1771.979800][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1771.987814][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1771.999007][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.007154][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1772.049932][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.058048][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1772.070136][T23023] loop5: detected capacity change from 0 to 16 [ 1772.088836][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.097741][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1772.110779][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.118790][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1772.129943][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.138145][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1772.149534][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.157519][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1772.168667][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.176669][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1772.202278][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.210403][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1772.221609][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.229689][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1772.240890][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.249688][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1772.260870][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.268919][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:12:03 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffff000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:03 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000207000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:03 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001000c004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:03 executing program 1: clone3(0x0, 0x0) 03:12:03 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1100, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:03 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001000d004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1772.387378][T22999] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.395760][T22999] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e 03:12:03 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_SCRNMAP(r0, 0x4b41, &(0x7f0000001340)) 03:12:03 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000008000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:03 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001000e004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:03 executing program 1: clone3(0x0, 0x0) 03:12:03 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010010004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:03 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000009000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1772.479391][T23048] loop5: detected capacity change from 0 to 16 [ 1772.513193][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1772.521566][T23049] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1772.559863][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.567901][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1772.591870][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.600274][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1772.649777][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.657817][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1772.669025][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.677034][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1772.696963][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.705108][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1772.716872][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.724879][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1772.762065][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.770330][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1772.784987][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.793098][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1772.805903][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.814048][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1772.825435][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.833830][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1772.845963][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.854085][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000c48c93fe [ 1772.873194][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.881531][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1772.892903][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.900875][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1772.912057][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.920065][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1772.947712][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.955853][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1772.967421][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.975436][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1772.989800][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1772.998206][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1773.009551][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.017666][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1773.029064][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.037187][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1773.049216][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.057325][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1773.069159][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.077160][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1773.088508][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.096648][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1773.108131][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.116220][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1773.127623][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.135613][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1773.154079][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.162176][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1773.173396][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.181546][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1773.193972][T23049] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.202088][T23049] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:04 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:04 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) 03:12:04 executing program 1: clone3(0x0, 0x0) 03:12:04 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1200, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:04 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000000a000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:04 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010011004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:04 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000000b000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1773.235531][T23079] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1773.244337][T23079] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1773.260310][T23079] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.268364][T23079] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:12:04 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1300, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1773.319374][T23087] loop5: detected capacity change from 0 to 16 [ 1773.321819][T23091] validate_nla: 58 callbacks suppressed [ 1773.321831][T23091] netlink: 'syz-executor.0': attribute type 4 has an invalid length. 03:12:04 executing program 1: clone3(&(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000001440)=[0x0], 0x1}, 0x58) 03:12:04 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000000c000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1773.363051][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1773.367138][T23091] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1773.371432][T23092] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1773.386278][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.398840][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:12:04 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010012004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1773.413800][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.418140][T23091] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1773.421880][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1773.431834][T23104] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1773.478081][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.486634][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1773.498063][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.506168][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1773.526487][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.534493][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1773.546053][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.554060][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1773.582624][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.590641][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1773.604503][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.612539][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1773.625001][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.633475][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1773.644825][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.652809][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1773.664165][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.672135][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000d03896d3 [ 1773.750455][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.758723][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000a3366fbc [ 1773.779025][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.787171][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e 03:12:04 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000000d000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1773.798764][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.806812][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1773.818256][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.826270][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1773.847443][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.855560][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1773.864194][T23112] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1773.877627][T23112] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1773.881959][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.887688][T23112] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1773.893817][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1773.902615][T23116] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1773.914468][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.928971][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1773.940424][T23114] loop5: detected capacity change from 0 to 16 [ 1773.940497][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.954815][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1773.969901][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.978091][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1773.989907][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1773.998086][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1774.015730][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.023765][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1774.035634][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.043672][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1774.055411][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.063512][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1774.074821][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.082846][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:12:04 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:04 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010016004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:04 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1400, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:04 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r0, 0x11, 0x64, &(0x7f0000000100), 0x4) 03:12:04 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000000e000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1774.187790][T23092] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.196055][T23092] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e 03:12:05 executing program 1: clone3(&(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000001440)=[0x0], 0x1}, 0x58) 03:12:05 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000000f000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:05 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2c, r1, 0x3, 0x0, 0x0, {}, [@ETHTOOL_A_PAUSE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge0\x00'}]}]}, 0x2c}}, 0x0) 03:12:05 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010017004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1774.278818][T23137] loop5: detected capacity change from 0 to 16 [ 1774.307208][T23142] netlink: 'syz-executor.0': attribute type 4 has an invalid length. 03:12:05 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000010000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1774.324551][T23142] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1774.339609][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1774.348052][T23136] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:12:05 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1500, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:05 executing program 2: r0 = socket$unix(0x1, 0x2, 0x0) sendmmsg$unix(r0, &(0x7f0000002880)=[{&(0x7f0000000040)=@abs={0x1}, 0x6e, &(0x7f0000000200)=[{&(0x7f00000000c0)="85", 0x1}, {&(0x7f0000000100)=':', 0x1}], 0x2}], 0x1, 0x0) [ 1774.380948][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.389005][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1774.404016][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.412280][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1774.461063][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.469176][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1774.480696][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.488724][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1774.508919][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.516931][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1774.528903][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.536911][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1774.566441][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.574655][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1774.589259][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.597325][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1774.611316][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.619382][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1774.630661][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.638679][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1774.650845][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.658861][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087224339 [ 1774.678539][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.686540][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1774.697636][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.705628][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1774.716821][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.724812][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1774.774086][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.782240][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1774.782662][T23169] loop5: detected capacity change from 0 to 16 [ 1774.796360][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.807803][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1774.828095][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.836152][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1774.847761][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.855896][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1774.867443][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.875467][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1774.887200][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.895214][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1774.921438][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.929701][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1774.941156][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.949287][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1774.960742][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.968905][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1774.980186][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1774.988285][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1775.080122][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.088173][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1775.099513][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.107517][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1775.119192][T23136] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:12:05 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:05 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010018004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:05 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NET_DM_CMD_STOP(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 03:12:05 executing program 1: clone3(&(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 03:12:05 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000410000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:05 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1600, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1775.127204][T23136] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1775.165269][T23176] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 03:12:05 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000011000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1775.173579][T23176] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:12:06 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001001e004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:06 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) 03:12:06 executing program 1: clone3(&(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 03:12:06 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000012000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1775.245578][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1775.250277][T23188] loop5: detected capacity change from 0 to 16 [ 1775.253949][T23191] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:12:06 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1700, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1775.300677][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.308754][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1775.328874][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.337215][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1775.385144][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.393298][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1775.404907][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.413053][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1775.432659][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.440633][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1775.451878][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.459985][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1775.489507][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.497521][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1775.511512][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.519682][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1775.532349][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.540490][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1775.551852][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.559881][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1775.571465][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.579641][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ace3aae9 [ 1775.659701][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.667775][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000a5c9c915 [ 1775.687544][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.695667][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1775.706914][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.714913][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1775.726096][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.734090][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1775.759782][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.767914][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1775.784430][T23220] loop5: detected capacity change from 0 to 16 [ 1775.784801][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.798715][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1775.811632][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.819654][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1775.830857][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.838962][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1775.850461][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.858489][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1775.870340][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.878344][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1775.890167][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.898159][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1775.909447][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.917424][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1775.928607][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.936591][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1775.947814][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1775.956501][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1776.058730][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.066794][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1776.078350][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.086510][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1776.099629][T23191] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:12:06 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000014000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:06 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010025004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:06 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1800, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:06 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:06 executing program 1: clone3(&(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 03:12:06 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000216000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1776.107693][T23191] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:06 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1900, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:06 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010048004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1776.186971][T23241] loop5: detected capacity change from 0 to 16 [ 1776.212540][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1776.220832][T23244] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1776.237601][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.245634][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1776.263004][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.271084][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1776.320561][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.328842][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1776.340214][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.348229][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1776.370048][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.378166][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1776.390413][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.398426][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1776.430008][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.438227][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1776.452291][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.460279][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1776.472940][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.480959][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1776.492095][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.500196][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1776.512050][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.520122][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ab252cf1 [ 1776.610095][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.618147][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000bc0a380a [ 1776.639023][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.647038][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1776.658615][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.666621][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1776.677858][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.685990][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1776.704819][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.712853][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1776.725473][T23259] loop5: detected capacity change from 0 to 16 [ 1776.731654][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.739798][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1776.754887][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.762904][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1776.774765][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.782894][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1776.794373][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.802428][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1776.813532][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.821592][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1776.833620][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.841681][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1776.852929][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.860950][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1776.872328][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.880302][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1776.891454][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.899456][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1776.979016][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1776.987099][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1776.998479][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1777.007212][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1777.018656][T23244] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1777.026702][T23244] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1777.060360][T23267] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1777.068649][T23267] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1777.086808][T23267] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1777.094984][T23267] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:12:09 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NET_DM_CMD_STOP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14}, 0x14}}, 0x40) 03:12:09 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000018000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:09 executing program 1: clone3(&(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000001440)}, 0x58) 03:12:09 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001004c004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:09 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1a00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:09 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e020000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:09 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000218000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:09 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000019000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:09 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockname(r0, 0x0, &(0x7f00000010c0)) 03:12:09 executing program 1: clone3(&(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000001440)}, 0x58) [ 1778.328243][T23277] validate_nla: 22 callbacks suppressed [ 1778.328254][T23277] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1778.343727][T23280] loop5: detected capacity change from 0 to 16 [ 1778.343964][T23277] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1778.359080][T23277] netlink: 'syz-executor.0': attribute type 4 has an invalid length. 03:12:09 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010060004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:09 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000001b000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:09 executing program 2: syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000380)=[{0x0}], 0x1008080, &(0x7f0000000400)={[{@check_strict}, {@dmode}, {@utf8}, {@overriderock}, {@sbsector}], [{@fsmagic}]}) [ 1778.370990][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1778.379467][T23281] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1778.396364][T23286] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1778.432115][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.440143][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1778.454548][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.462673][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 03:12:09 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1b00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1778.508195][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.516560][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1778.527735][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.535731][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1778.556333][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.564472][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1778.575690][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.583700][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1778.614999][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.623047][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1778.637376][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.645687][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1778.658596][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.666729][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1778.677957][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.685986][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1778.698395][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.706407][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000f02c92c6 [ 1778.726284][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.734791][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1778.746075][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.754339][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1778.766124][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.774234][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:09 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000400)={0x28, 0x3, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x28}}, 0x0) 03:12:09 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000020000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1778.809080][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.817133][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1778.842127][T23309] loop5: detected capacity change from 0 to 16 03:12:09 executing program 1: clone3(&(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000001440)}, 0x58) [ 1778.855110][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.855665][T23314] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1778.863176][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1778.874236][T23314] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1778.884172][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.893429][T23314] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1778.898453][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1778.911693][T23317] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1778.917863][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.933767][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1778.945681][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.953750][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1778.964870][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.972867][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1778.991534][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1778.999673][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1779.011032][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.019061][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1779.030348][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.038448][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1779.049580][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.057741][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1779.156857][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.165069][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1779.176828][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.184850][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1779.196042][T23281] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:12:09 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:09 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010068004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:09 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1c00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:10 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000001020000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1779.204274][T23281] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:10 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000040)={{{@in6=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}}, {{@in=@broadcast}, 0x0, @in6=@loopback}}, 0xe4) 03:12:10 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001006c004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:10 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x0, @private=0xa010102}}}, 0x84) 03:12:10 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1d00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:10 executing program 1: syz_genetlink_get_family_id$smc(&(0x7f0000000140), 0xffffffffffffffff) 03:12:10 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000022000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1779.282941][T23338] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1779.298037][T23340] loop5: detected capacity change from 0 to 16 [ 1779.301523][T23338] netlink: 'syz-executor.0': attribute type 4 has an invalid length. 03:12:10 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000025000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1779.476941][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1779.485237][T23339] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:12:10 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x4102, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) perf_event_open(&(0x7f0000000000)={0x1000000002, 0x80, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) [ 1779.531187][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.539228][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1779.554210][T23364] loop5: detected capacity change from 0 to 16 [ 1779.556466][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.568575][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1779.622195][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.630342][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1779.641605][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.649700][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1779.669681][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.677846][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1779.689592][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.697612][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1779.734399][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.742494][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1779.756106][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.764127][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1779.777054][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.785053][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1779.796245][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.804245][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1779.815798][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.824479][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000057de42ba [ 1779.919288][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.927430][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ceb0ba32 [ 1779.947565][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.955758][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1779.967174][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.975261][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1779.986457][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1779.994809][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1780.020679][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.028720][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1780.045075][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.054875][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1780.067084][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.075282][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1780.087182][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.095166][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1780.106667][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.114726][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1780.126568][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.134608][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1780.147244][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.155375][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 03:12:10 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:10 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010074004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:10 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1e00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:10 executing program 1: r0 = openat$null(0xffffff9c, &(0x7f0000000480), 0x0, 0x0) syz_genetlink_get_family_id$smc(&(0x7f00000008c0), r0) 03:12:10 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000029000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:10 executing program 2: add_key$user(&(0x7f00000000c0), &(0x7f0000000000)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) [ 1780.166711][T23339] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.174698][T23339] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 03:12:11 executing program 2: timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}}, &(0x7f0000000040)) 03:12:11 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000229000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:11 executing program 1: r0 = socket(0x2, 0xa, 0x0) getpeername$inet(r0, 0x0, 0x0) 03:12:11 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff0600000001007a004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:11 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x1f00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1780.260760][T23397] loop5: detected capacity change from 0 to 16 03:12:11 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000022c000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1780.399386][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1780.407705][T23401] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1780.440543][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.448583][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1780.477307][T23419] loop5: detected capacity change from 0 to 16 [ 1780.486588][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.494651][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1780.540689][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.548999][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1780.560429][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.568536][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1780.588048][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.596082][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1780.607423][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.615417][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1780.652160][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.660312][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1780.674338][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.682350][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1780.695026][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.703037][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1780.714228][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.722577][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1780.733873][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.741846][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000f02c92c6 [ 1780.839475][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.847696][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000097832124 [ 1780.867244][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.875321][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1780.886664][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.894808][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1780.906164][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.914239][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1780.944691][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.952754][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1780.969819][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.977860][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1780.990242][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1780.998312][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1781.009571][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.017585][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1781.028953][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.036948][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1781.048300][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.056612][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1781.068619][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.076790][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1781.088003][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.096009][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1781.107224][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.115471][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1781.126806][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:12:11 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:11 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x11) 03:12:11 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100fc004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:11 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2000, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:11 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) 03:12:11 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000022d000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:11 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000002e000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:11 executing program 2: waitid(0x1, 0x0, &(0x7f0000000080), 0x8, &(0x7f0000000100)) 03:12:11 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100fd004500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1781.134998][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1781.153356][T23401] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.161649][T23401] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e 03:12:12 executing program 1: r0 = openat$bsg(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$cgroup_int(r0, &(0x7f0000000100)='cpuset.sched_load_balance\x00', 0x2, 0x0) [ 1781.221770][T23440] loop5: detected capacity change from 0 to 16 [ 1781.259811][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 03:12:12 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000800)={0x20, 0x0, 0x8, 0x401, 0x0, 0x0, {}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x0) 03:12:12 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000032000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1781.268135][T23444] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1781.317010][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.325088][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1781.349243][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.357470][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1781.404424][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.412796][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1781.424272][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.432284][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1781.453504][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.461500][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1781.472635][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.480836][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1781.518462][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.526471][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1781.540215][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.548329][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1781.560821][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.568888][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1781.580330][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.588331][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1781.600901][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.609031][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ceb0ba32 [ 1781.628202][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.636565][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1781.647681][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.655719][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1781.666940][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.674952][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1781.705194][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.713245][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1781.725893][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.733932][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1781.746220][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.754258][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1781.765505][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.773492][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1781.785289][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.793376][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1781.804552][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.812665][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1781.824431][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.832423][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1781.843619][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.851644][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1781.863024][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.871262][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1781.882487][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.890556][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1781.909894][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.917943][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1781.929271][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.937384][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1781.948814][T23444] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1781.957014][T23444] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:12 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:12 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100fa014500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:12 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2500, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:12 executing program 1: socket$inet(0x2, 0xa, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_PROTOCOLS(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={0x0}}, 0x0) 03:12:12 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCDELRT(r0, 0x890c, &(0x7f0000000040)={0x0, @tipc=@id, @l2={0x1f, 0x0, @none}, @ax25={0x3, @null, 0x1}}) 03:12:12 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000003e000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:12 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100fe014500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:12 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000003f000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1781.996075][T23473] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1782.004473][T23473] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1782.020348][T23473] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.028470][T23473] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:12:12 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet(r0, &(0x7f0000000940)=[{{&(0x7f00000001c0)={0x2, 0x4e20, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000000540)=[@ip_ttl={{0x14, 0x0, 0x2, 0x9}}], 0x18}}], 0x1, 0x0) 03:12:12 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000007140)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x0, @private0}, 0x1c, 0x0}}], 0x1, 0x0) 03:12:12 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2a00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1782.096774][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1782.105110][T23486] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1782.109962][T23484] loop5: detected capacity change from 0 to 16 03:12:12 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000040000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1782.157793][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.166089][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1782.181217][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.189286][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1782.238434][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.246569][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1782.258138][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.266252][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1782.286632][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.294705][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1782.306804][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.314817][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1782.345598][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.353707][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1782.367755][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.375814][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1782.388262][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.396479][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1782.407918][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.415933][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1782.427754][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.435938][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000006a6cc15a [ 1782.518975][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.527127][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020cca8f9 [ 1782.547207][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.555252][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1782.566583][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.574695][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1782.585997][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.594127][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1782.633026][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.641061][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1782.653481][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.654724][T23510] loop5: detected capacity change from 0 to 16 [ 1782.661506][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1782.680192][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.688347][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1782.699485][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.707609][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1782.719330][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.727521][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1782.738649][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.746651][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1782.765553][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.773573][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1782.784899][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.792941][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1782.804163][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.812174][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1782.823544][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.831523][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:12:13 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x630b0000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:13 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_VERDICT_BATCH(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000680)={0x14, 0x3, 0x3, 0x101}, 0x14}}, 0x0) 03:12:13 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010004024500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:13 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000048000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:13 executing program 1: pselect6(0x40, &(0x7f0000000000), &(0x7f0000000100), 0x0, &(0x7f00000001c0), 0x0) 03:12:13 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x3f00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1782.936120][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.944798][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1782.956128][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1782.964372][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1782.975948][T23486] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:12:13 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000004c000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:13 executing program 2: r0 = socket$inet(0x2, 0xa, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000740)={'vcan0\x00'}) [ 1782.983969][T23486] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:13 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100f8024500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:13 executing program 1: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)={0x34, r0, 0x11, 0x0, 0x0, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}]}, 0x34}}, 0x0) 03:12:13 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000352000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:13 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000034500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1783.064784][T23530] loop5: detected capacity change from 0 to 16 [ 1783.092642][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1783.100932][T23532] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1783.143444][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.151572][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1783.184520][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.193038][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1783.240781][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.248801][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1783.260281][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.268299][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1783.289161][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.297336][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1783.308833][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.316924][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1783.354785][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.362897][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1783.376928][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.385041][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1783.397620][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.405682][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1783.416824][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.425015][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1783.437090][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.445179][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000ee87965d [ 1783.464364][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.472373][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1783.483656][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.491762][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1783.502969][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.510971][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1783.539442][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.547477][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1783.554038][T23562] validate_nla: 38 callbacks suppressed [ 1783.554050][T23562] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1783.573833][T23562] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1783.574910][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.583241][T23562] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1783.589936][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1783.598536][T23566] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1783.612632][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.625168][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1783.636447][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.644533][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1783.656417][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.664434][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1783.675598][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.683711][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1783.695355][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.703353][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1783.714636][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.722610][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1783.733957][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.742002][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1783.753139][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.761099][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1783.779118][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.787126][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1783.798261][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.806275][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1783.817492][T23532] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.825533][T23532] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:14 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:14 executing program 1: pipe(&(0x7f0000000d40)={0xffffffffffffffff}) bind$netlink(r0, 0x0, 0x0) 03:12:14 executing program 2: socketpair(0x10, 0x3, 0x7, &(0x7f0000000940)) 03:12:14 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x4000, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:14 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000059000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:14 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100f4034500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:14 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000005a000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1783.857720][T23567] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1783.866358][T23567] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1783.881991][T23567] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1783.889969][T23567] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:12:14 executing program 1: pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240)={0x0}) 03:12:14 executing program 2: r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffe000/0x2000)=nil) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000040)=""/36) [ 1783.943011][T23575] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1783.958065][T23577] loop5: detected capacity change from 0 to 16 [ 1783.965128][T23575] netlink: 'syz-executor.0': attribute type 4 has an invalid length. 03:12:14 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100f6034500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:14 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000025a000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:14 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010002044500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1783.990470][T23575] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1783.998981][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1783.999855][T23583] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1784.007256][T23579] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1784.053672][T23592] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1784.061976][T23592] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1784.075979][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.084016][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1784.107052][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.115224][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1784.163311][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.171430][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1784.182991][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.191058][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1784.210057][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.218088][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1784.229684][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.237802][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1784.273991][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.282192][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1784.296188][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.304238][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1784.317077][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.325282][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1784.336485][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.344622][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1784.358057][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.366142][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1784.379373][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.387557][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1784.398901][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.407028][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1784.434829][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.442972][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1784.469716][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.477788][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1784.490563][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.498560][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1784.509781][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.517865][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1784.529277][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.537260][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1784.548470][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.556567][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1784.568393][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.576377][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1784.587540][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.595566][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1784.606841][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.614832][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1784.626012][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.634153][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1784.653021][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.661026][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1784.672151][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.680130][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1784.691864][T23579] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.699837][T23579] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:15 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:15 executing program 1: r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffe000/0x2000)=nil) shmat(r0, &(0x7f0000ffa000/0x4000)=nil, 0x0) 03:12:15 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NL80211_CMD_DISASSOCIATE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)={0x14, 0x0, 0x0, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x44) 03:12:15 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x4800, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:15 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000005b000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:15 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000054500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:15 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000064500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:15 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NL80211_CMD_DISASSOCIATE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0}}, 0x0) [ 1784.732254][T23607] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1784.740673][T23607] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1784.756448][T23607] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.764563][T23607] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:12:15 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000005c000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:15 executing program 1: syz_io_uring_setup(0x6827, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x0, 0x8000000}, &(0x7f0000003000/0x2000)=nil, &(0x7f0000004000/0x3000)=nil, 0x0, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f00000098c0)=[{{0x0, 0x0, &(0x7f0000003940)=[{&(0x7f0000002900)="1c5f7c4a9bdb2203cf740d0932fd6fb908b95d501f0f2b9b12b414a9730a5c78511513c691f11909c628b7c64d0584492dc71a5d7cd455c2b1e6a75807ffecd76aa7d108b4ef6b685f6208ca2819cd5a4f8e803e6d12ccf234c84cf52c93651f1816d96c1d2989e7f8bb4127a22f0f050f9509084d31b572658b3d48d93bb18758cee34d635a03766484e4e1f13ee23eef298aba1cc0487b56be7ed519f517ede43d0a56ddaf2c0fffcd30d1fb32a452a0ec3a37b65616471ff170d396ac22acec690cc7c9157c175f406219b780515171d8e7b7de5ed2c6f5530171b204ffb30b8eaab5ff48710f21dc6a4f3920cd5badb95d2a6cbde757c3d12a4c313ac86cc6adcc95b60b3423696edb1d43caeb9817d0ef06045ae627bc0ea5db13a3c88cbe565490f32ede7471183dede0a593b064f22e3769fdd9a819b153a8d3d7f518a28c3f019fcd71595364682960b7d6c5fc3042be8859fd22fd0db8d1befea2553ab9034cb4a6ad122f6f727b8c4f2c408e11a0fc7e6f15fe62ccebc05231a5181859e2e94279df5271239e2edfa5499bdc49e82412851f5225c4d5968b150fbb34a495ca52d71296f2e08fbbb7bc879dd4775724fdb04351918b14619fc038a604763c5200033964df5d718bd76e3fc322c8575876146a10668d70e84c83958b97bf07713ff1fe4a1216d2722ebdc5930474043f026760f373fce8acf66607f70ee42a2099c19f7a8036bc2cc35cc678cc925099e63aa457bc9deb4ac74c979d659c02c4fb8b9977a6a9bc4a78e757e7700bf34c801a69c397f8dbcd4f95edeac0c804a3a2f4a3f92bb88004957c8e9819ce0eee0818e858adb8a4b200952bf224787bde9aaa5dcc970b16ebce2db7ab0f9809235bdf41bfc64419e685e9c77d56a1d732ee9779db26199338c6d77ad3e032b75ebe973b9138197ba62ecb7db443ad519c137dee7fb52d8ffdb0596f5e49b4e202dd1eca465e3fd6bc4f1cdca0b4aee3754d87983c0cd2b2b691afc6483c0d7e8a84b5769fef1da54bc789f697910615bab3798ace944a6f61272fc284b4217a2332886d550990ecec6746aba9d10fcbe1ee2e7760c1a4cde3de9ab8a7e4481ce077b008bf6bf00952d8e609b3e2d95919af635104981fb7a3ca199e09764c53e122ce518ecba81a6f4e789a63761bc0f394f1298aa0014715ee1df19ba31ef37160894b66ca5504b23e5ee85546e563c5fa3c3b51c688d6e87dec2d42c3137f803880d119da3ce62a8e97ba76026328fd513a53b3d80432fa8b19992b7085d8412fc740928d7ac26610bbf01d601f34562c30f08ff6a043db5e049079e4856cdaf5109feb8c6dff4dfc52aeaa174c0196a98a31fab6d1ba630c7c5d6ab154aa61e56386fb08f79205e837c7dfa11ef6c0036307e7c28e4b85f11124d2e1792b2740d3cbb0936ae1fb7736eaf6294aecccfa441e5f35994ca4a8efe47f212933c892328008ecd5066da41641bc1d219b1ce4b014e81ddd7ce0c117a92b7c3931cf2e1973b792080703265fa435c87dbe92d3211863a59e1a492d140b9fd87a5ac25bf5e59d8788ad3e7bf515007fce3f8d320004cb9c8781c80f05d6b5e7967f4aff9e94f8efb2d29e35148a93dec6d87a0bd1f878c297875f11e67e2b82f5afa918bbfdeaacb4d2818f79045af475287b35d2c16b4b0e7e58e29f5309eb6e0e3d6e15889e489a53447189f7b5f16063068452dc37f6a358cd7bb3fdbd43216f5c76eb4af73ecfb73f4cd3fab30c898699f95e3fad149b3058dd620aa811587db5583ff53f013e357a516fc5678033163fa52e5280de22679154e79533ab0b4cc9ebc58a7c9e0c559cc0858f992d049e814f2b6e8cdb9f8b981c6a5f7dca9cab1fd15a4f0405c328436ab7af3a3292f4e448b9e80801026a2f32e8e4595743a1f01a407622f4918a8290d8beddaea35c49f1d255a642556c8cd8339df9499caeb63d3abf6fbca6d959ae18b8b98e41b02ead51a32d17a6569db7d31d00e031a7fb495d5fc321dd06d5d8ac49f44642e8439a42469eecf4c9c09f8114a779e7e6890580398cc050c0bcb6cbf49aef4f330879a9664f261e82d0309fcbbac971e09b87556cb773ddcde664362aff216c1ec196c99e23fc71c94359e6ff6a38e5cab66139f1cd27d7024114cd806ac746aeaae549cfebe0441a937ee2e8aaecec0d0c4f4419dfeedd7064e30392ad80aca2f5541cbf404d596f61181df041eed86683e5d52677846ea473cfe449009cc05daf83d942129351481a558e8990b45dba34b714697b72e2fde2651ddf0da3430f9c3439a0acbb413532727558df06e26bef7c71db417c48c211a31af0ba1ae4b892665223dc4c38879a71574335f3c010de48210835361faa7cfd5b08e67d9ec47a1c62c105613c2734eae44b216fa105443880dfcd269a3244b6b4819475b8741989094cd6134218cfc28d80db306e9933a70ea25501f9bcb8e5ba32a980a1ebec6d7fce2e4ffa3ddfcce361acf5d015377c94b44bd7cef359bc5d40f3e06060008822a43cdba630e4e068d76bd9d5831dbf6ee7178633888b1c7697da0a50f3915e2c7c108346abeb17e1c0d5cef00918e09e14fd100599bc3513d1fccb7572", 0x743}], 0x1}}], 0x1, 0x0) select(0x40, &(0x7f0000000200), 0x0, &(0x7f0000000280)={0x8}, 0x0) [ 1784.826712][T23619] loop5: detected capacity change from 0 to 16 [ 1784.859200][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1784.867624][T23618] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:12:15 executing program 2: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000a00), 0x0, 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0}) select(0x40, &(0x7f0000000000)={0x9}, &(0x7f0000000040)={0x6}, 0x0, &(0x7f0000000100)={r0}) 03:12:15 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000005d000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1784.900254][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.908329][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1784.923646][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1784.931800][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1784.997763][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.005799][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1785.017375][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.025367][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1785.048387][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.056511][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1785.068942][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.076962][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1785.112948][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.121048][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1785.135848][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.143877][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1785.157212][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.165269][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1785.177074][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.185069][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1785.197682][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.205679][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000a3366fbc [ 1785.227957][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.236446][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1785.248447][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.256458][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1785.268152][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.276231][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1785.315226][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.324255][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1785.336622][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.344648][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1785.360922][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.368981][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1785.381274][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.389406][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1785.401882][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.409868][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1785.422529][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.430554][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1785.443418][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.451499][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1785.463309][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.471342][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1785.484223][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.492241][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1785.504050][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.512059][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1785.533993][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.542017][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1785.554666][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.562709][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1785.574557][T23618] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.582723][T23618] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:16 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70030000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x4c00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:16 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000074500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:16 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000060000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:16 executing program 2: syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) [ 1785.649593][T23649] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1785.657890][T23649] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1785.736538][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1785.744929][T23654] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1785.762279][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.770303][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1785.787986][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.796028][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1785.852120][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1785.860150][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 03:12:16 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000068000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:16 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x79, &(0x7f00000001c0)="08ac20080dd966953b67480f3a62007c4fab98a907010100d6eca02cdc108ce69ae431c026d5190eb8a104ce5f19cd2ed75fcd792d92ad8696ca0688b72e34c4504ebda2000000000000003305603895940fd837a00b5901f87c646f6f8e7b11f24ca0a35332dc5bd3da36595c2715ccc2fd056f2d6f0730fd"}}], 0x1c) wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b7ecb6974f527cc14538d1efb1ffe03284f6d33265be9c604b293f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x17) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 03:12:16 executing program 1: syz_io_uring_setup(0x6827, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x0, 0x8000000}, &(0x7f0000003000/0x2000)=nil, &(0x7f0000004000/0x3000)=nil, 0x0, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f00000098c0)=[{{0x0, 0x0, &(0x7f0000003940)=[{&(0x7f0000002900)="1c5f7c4a9bdb2203cf740d0932fd6fb908b95d501f0f2b9b12b414a9730a5c78511513c691f11909c628b7c64d0584492dc71a5d7cd455c2b1e6a75807ffecd76aa7d108b4ef6b685f6208ca2819cd5a4f8e803e6d12ccf234c84cf52c93651f1816d96c1d2989e7f8bb4127a22f0f050f9509084d31b572658b3d48d93bb18758cee34d635a03766484e4e1f13ee23eef298aba1cc0487b56be7ed519f517ede43d0a56ddaf2c0fffcd30d1fb32a452a0ec3a37b65616471ff170d396ac22acec690cc7c9157c175f406219b780515171d8e7b7de5ed2c6f5530171b204ffb30b8eaab5ff48710f21dc6a4f3920cd5badb95d2a6cbde757c3d12a4c313ac86cc6adcc95b60b3423696edb1d43caeb9817d0ef06045ae627bc0ea5db13a3c88cbe565490f32ede7471183dede0a593b064f22e3769fdd9a819b153a8d3d7f518a28c3f019fcd71595364682960b7d6c5fc3042be8859fd22fd0db8d1befea2553ab9034cb4a6ad122f6f727b8c4f2c408e11a0fc7e6f15fe62ccebc05231a5181859e2e94279df5271239e2edfa5499bdc49e82412851f5225c4d5968b150fbb34a495ca52d71296f2e08fbbb7bc879dd4775724fdb04351918b14619fc038a604763c5200033964df5d718bd76e3fc322c8575876146a10668d70e84c83958b97bf07713ff1fe4a1216d2722ebdc5930474043f026760f373fce8acf66607f70ee42a2099c19f7a8036bc2cc35cc678cc925099e63aa457bc9deb4ac74c979d659c02c4fb8b9977a6a9bc4a78e757e7700bf34c801a69c397f8dbcd4f95edeac0c804a3a2f4a3f92bb88004957c8e9819ce0eee0818e858adb8a4b200952bf224787bde9aaa5dcc970b16ebce2db7ab0f9809235bdf41bfc64419e685e9c77d56a1d732ee9779db26199338c6d77ad3e032b75ebe973b9138197ba62ecb7db443ad519c137dee7fb52d8ffdb0596f5e49b4e202dd1eca465e3fd6bc4f1cdca0b4aee3754d87983c0cd2b2b691afc6483c0d7e8a84b5769fef1da54bc789f697910615bab3798ace944a6f61272fc284b4217a2332886d550990ecec6746aba9d10fcbe1ee2e7760c1a4cde3de9ab8a7e4481ce077b008bf6bf00952d8e609b3e2d95919af635104981fb7a3ca199e09764c53e122ce518ecba81a6f4e789a63761bc0f394f1298aa0014715ee1df19ba31ef37160894b66ca5504b23e5ee85546e563c5fa3c3b51c688d6e87dec2d42c3137f803880d119da3ce62a8e97ba76026328fd513a53b3d80432fa8b19992b7085d8412fc740928d7ac26610bbf01d601f34562c30f08ff6a043db5e049079e4856cdaf5109feb8c6dff4dfc52aeaa174c0196a98a31fab6d1ba630c7c5d6ab154aa61e56386fb08f79205e837c7dfa11ef6c0036307e7c28e4b85f11124d2e1792b2740d3cbb0936ae1fb7736eaf6294aecccfa441e5f35994ca4a8efe47f212933c892328008ecd5066da41641bc1d219b1ce4b014e81ddd7ce0c117a92b7c3931cf2e1973b792080703265fa435c87dbe92d3211863a59e1a492d140b9fd87a5ac25bf5e59d8788ad3e7bf515007fce3f8d320004cb9c8781c80f05d6b5e7967f4aff9e94f8efb2d29e35148a93dec6d87a0bd1f878c297875f11e67e2b82f5afa918bbfdeaacb4d2818f79045af475287b35d2c16b4b0e7e58e29f5309eb6e0e3d6e15889e489a53447189f7b5f16063068452dc37f6a358cd7bb3fdbd43216f5c76eb4af73ecfb73f4cd3fab30c898699f95e3fad149b3058dd620aa811587db5583ff53f013e357a516fc5678033163fa52e5280de22679154e79533ab0b4cc9ebc58a7c9e0c559cc0858f992d049e814f2b6e8cdb9f8b981c6a5f7dca9cab1fd15a4f0405c328436ab7af3a3292f4e448b9e80801026a2f32e8e4595743a1f01a407622f4918a8290d8beddaea35c49f1d255a642556c8cd8339df9499caeb63d3abf6fbca6d959ae18b8b98e41b02ead51a32d17a6569db7d31d00e031a7fb495d5fc321dd06d5d8ac49f44642e8439a42469eecf4c9c09f8114a779e7e6890580398cc050c0bcb6cbf49aef4f330879a9664f261e82d0309fcbbac971e09b87556cb773ddcde664362aff216c1ec196c99e23fc71c94359e6ff6a38e5cab66139f1cd27d7024114cd806ac746aeaae549cfebe0441a937ee2e8aaecec0d0c4f4419dfeedd7064e30392ad80aca2f5541cbf404d596f61181df041eed86683e5d52677846ea473cfe449009cc05daf83d942129351481a558e8990b45dba34b714697b72e2fde2651ddf0da3430f9c3439a0acbb413532727558df06e26bef7c71db417c48c211a31af0ba1ae4b892665223dc4c38879a71574335f3c010de48210835361faa7cfd5b08e67d9ec47a1c62c105613c2734eae44b216fa105443880dfcd269a3244b6b4819475b8741989094cd6134218cfc28d80db306e9933a70ea25501f9bcb8e5ba32a980a1ebec6d7fce2e4ffa3ddfcce361acf5d015377c94b44bd7cef359bc5d40f3e06060008822a43cdba630e4e068d76bd9d5831dbf6ee7178633888b1c7697da0a50f3915e2c7c108346abeb17e1c0d5cef00918e09e14fd100599bc3513d1fccb7572", 0x743}], 0x1}}], 0x1, 0x0) select(0x40, &(0x7f0000000200), 0x0, &(0x7f0000000280)={0x8}, 0x0) [ 1785.995874][T23660] loop5: detected capacity change from 0 to 16 [ 1786.008316][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.016506][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1786.035553][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.043564][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1786.054964][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.063021][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1786.073149][T23660] loop5: detected capacity change from 0 to 16 [ 1786.082921][T23660] FAT-fs (loop5): Unrecognized mount option "./bus" or missing value 03:12:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x6000, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1786.102929][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.111045][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1786.125601][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.133753][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1786.146354][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.154463][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1786.165684][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.173677][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1786.185263][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.193403][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000000ace092b [ 1786.278713][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.286856][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000005889cbd8 [ 1786.306346][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.314553][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e 03:12:17 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000094500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:17 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000006c000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1786.326336][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.334463][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1786.345682][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.353690][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:17 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x60ff, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1786.402614][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.411080][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1786.423627][T23687] loop5: detected capacity change from 0 to 16 [ 1786.438879][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.447116][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1786.469512][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.477560][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1786.489825][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.497854][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1786.510566][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.518598][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1786.532572][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.540591][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1786.554276][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.562463][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1786.573671][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.581653][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1786.593232][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.601397][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1786.612614][T23654] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1786.620579][T23654] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1787.053488][T23690] ================================================================== [ 1787.061955][T23690] BUG: KCSAN: data-race in io_submit_sqes / io_uring_poll [ 1787.069061][T23690] [ 1787.071380][T23690] write to 0xffff88812897e850 of 4 bytes by task 23691 on cpu 0: [ 1787.079091][T23690] io_submit_sqes+0x544/0xbd0 [ 1787.083804][T23690] io_sq_thread+0x74d/0x10b0 [ 1787.088406][T23690] ret_from_fork+0x1f/0x30 [ 1787.092816][T23690] [ 1787.095134][T23690] read to 0xffff88812897e850 of 4 bytes by task 23690 on cpu 1: [ 1787.102763][T23690] io_uring_poll+0x94/0x160 [ 1787.107341][T23690] do_select+0x901/0xf80 [ 1787.111581][T23690] core_sys_select+0x403/0x690 [ 1787.116337][T23690] __se_sys_select+0x17e/0x1c0 [ 1787.121094][T23690] __x64_sys_select+0x63/0x70 [ 1787.125775][T23690] do_syscall_64+0x4a/0x90 [ 1787.130199][T23690] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1787.136096][T23690] [ 1787.138410][T23690] Reported by Kernel Concurrency Sanitizer on: [ 1787.144553][T23690] CPU: 1 PID: 23690 Comm: syz-executor.1 Tainted: G W 5.13.0-rc3-syzkaller #0 [ 1787.154704][T23690] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1787.164754][T23690] ================================================================== [ 1787.299453][T23704] loop5: detected capacity change from 0 to 16 03:12:18 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x72010000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:18 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000272000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100000a4500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:18 executing program 1: syz_io_uring_setup(0x6827, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x0, 0x8000000}, &(0x7f0000003000/0x2000)=nil, &(0x7f0000004000/0x3000)=nil, 0x0, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f00000098c0)=[{{0x0, 0x0, &(0x7f0000003940)=[{&(0x7f0000002900)="1c5f7c4a9bdb2203cf740d0932fd6fb908b95d501f0f2b9b12b414a9730a5c78511513c691f11909c628b7c64d0584492dc71a5d7cd455c2b1e6a75807ffecd76aa7d108b4ef6b685f6208ca2819cd5a4f8e803e6d12ccf234c84cf52c93651f1816d96c1d2989e7f8bb4127a22f0f050f9509084d31b572658b3d48d93bb18758cee34d635a03766484e4e1f13ee23eef298aba1cc0487b56be7ed519f517ede43d0a56ddaf2c0fffcd30d1fb32a452a0ec3a37b65616471ff170d396ac22acec690cc7c9157c175f406219b780515171d8e7b7de5ed2c6f5530171b204ffb30b8eaab5ff48710f21dc6a4f3920cd5badb95d2a6cbde757c3d12a4c313ac86cc6adcc95b60b3423696edb1d43caeb9817d0ef06045ae627bc0ea5db13a3c88cbe565490f32ede7471183dede0a593b064f22e3769fdd9a819b153a8d3d7f518a28c3f019fcd71595364682960b7d6c5fc3042be8859fd22fd0db8d1befea2553ab9034cb4a6ad122f6f727b8c4f2c408e11a0fc7e6f15fe62ccebc05231a5181859e2e94279df5271239e2edfa5499bdc49e82412851f5225c4d5968b150fbb34a495ca52d71296f2e08fbbb7bc879dd4775724fdb04351918b14619fc038a604763c5200033964df5d718bd76e3fc322c8575876146a10668d70e84c83958b97bf07713ff1fe4a1216d2722ebdc5930474043f026760f373fce8acf66607f70ee42a2099c19f7a8036bc2cc35cc678cc925099e63aa457bc9deb4ac74c979d659c02c4fb8b9977a6a9bc4a78e757e7700bf34c801a69c397f8dbcd4f95edeac0c804a3a2f4a3f92bb88004957c8e9819ce0eee0818e858adb8a4b200952bf224787bde9aaa5dcc970b16ebce2db7ab0f9809235bdf41bfc64419e685e9c77d56a1d732ee9779db26199338c6d77ad3e032b75ebe973b9138197ba62ecb7db443ad519c137dee7fb52d8ffdb0596f5e49b4e202dd1eca465e3fd6bc4f1cdca0b4aee3754d87983c0cd2b2b691afc6483c0d7e8a84b5769fef1da54bc789f697910615bab3798ace944a6f61272fc284b4217a2332886d550990ecec6746aba9d10fcbe1ee2e7760c1a4cde3de9ab8a7e4481ce077b008bf6bf00952d8e609b3e2d95919af635104981fb7a3ca199e09764c53e122ce518ecba81a6f4e789a63761bc0f394f1298aa0014715ee1df19ba31ef37160894b66ca5504b23e5ee85546e563c5fa3c3b51c688d6e87dec2d42c3137f803880d119da3ce62a8e97ba76026328fd513a53b3d80432fa8b19992b7085d8412fc740928d7ac26610bbf01d601f34562c30f08ff6a043db5e049079e4856cdaf5109feb8c6dff4dfc52aeaa174c0196a98a31fab6d1ba630c7c5d6ab154aa61e56386fb08f79205e837c7dfa11ef6c0036307e7c28e4b85f11124d2e1792b2740d3cbb0936ae1fb7736eaf6294aecccfa441e5f35994ca4a8efe47f212933c892328008ecd5066da41641bc1d219b1ce4b014e81ddd7ce0c117a92b7c3931cf2e1973b792080703265fa435c87dbe92d3211863a59e1a492d140b9fd87a5ac25bf5e59d8788ad3e7bf515007fce3f8d320004cb9c8781c80f05d6b5e7967f4aff9e94f8efb2d29e35148a93dec6d87a0bd1f878c297875f11e67e2b82f5afa918bbfdeaacb4d2818f79045af475287b35d2c16b4b0e7e58e29f5309eb6e0e3d6e15889e489a53447189f7b5f16063068452dc37f6a358cd7bb3fdbd43216f5c76eb4af73ecfb73f4cd3fab30c898699f95e3fad149b3058dd620aa811587db5583ff53f013e357a516fc5678033163fa52e5280de22679154e79533ab0b4cc9ebc58a7c9e0c559cc0858f992d049e814f2b6e8cdb9f8b981c6a5f7dca9cab1fd15a4f0405c328436ab7af3a3292f4e448b9e80801026a2f32e8e4595743a1f01a407622f4918a8290d8beddaea35c49f1d255a642556c8cd8339df9499caeb63d3abf6fbca6d959ae18b8b98e41b02ead51a32d17a6569db7d31d00e031a7fb495d5fc321dd06d5d8ac49f44642e8439a42469eecf4c9c09f8114a779e7e6890580398cc050c0bcb6cbf49aef4f330879a9664f261e82d0309fcbbac971e09b87556cb773ddcde664362aff216c1ec196c99e23fc71c94359e6ff6a38e5cab66139f1cd27d7024114cd806ac746aeaae549cfebe0441a937ee2e8aaecec0d0c4f4419dfeedd7064e30392ad80aca2f5541cbf404d596f61181df041eed86683e5d52677846ea473cfe449009cc05daf83d942129351481a558e8990b45dba34b714697b72e2fde2651ddf0da3430f9c3439a0acbb413532727558df06e26bef7c71db417c48c211a31af0ba1ae4b892665223dc4c38879a71574335f3c010de48210835361faa7cfd5b08e67d9ec47a1c62c105613c2734eae44b216fa105443880dfcd269a3244b6b4819475b8741989094cd6134218cfc28d80db306e9933a70ea25501f9bcb8e5ba32a980a1ebec6d7fce2e4ffa3ddfcce361acf5d015377c94b44bd7cef359bc5d40f3e06060008822a43cdba630e4e068d76bd9d5831dbf6ee7178633888b1c7697da0a50f3915e2c7c108346abeb17e1c0d5cef00918e09e14fd100599bc3513d1fccb7572", 0x743}], 0x1}}], 0x1, 0x0) select(0x40, &(0x7f0000000200), 0x0, &(0x7f0000000280)={0x8}, 0x0) 03:12:18 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x6800, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:18 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100000b4500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1787.579056][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1787.587395][T23716] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1787.608821][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.616855][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1787.633132][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.641161][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1787.697985][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.706094][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1787.718591][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.726673][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1787.748921][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.756950][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1787.768120][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.776135][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1787.810649][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.818704][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1787.833035][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.841022][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1787.854914][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.862937][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1787.874191][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.882294][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1787.896165][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.904256][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1787.915998][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.923982][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1787.935411][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.943403][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1787.965355][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1787.973848][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1787.997374][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1788.005410][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1788.018692][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1788.026833][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1788.038850][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1788.046869][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1788.060314][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1788.068333][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1788.080135][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1788.088213][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1788.100910][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1788.108910][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1788.121999][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1788.130192][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1788.142172][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1788.149924][T23732] loop5: detected capacity change from 0 to 16 [ 1788.150244][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1788.169658][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1788.177834][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1788.190651][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1788.198682][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1788.210744][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1788.218749][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1788.230717][T23716] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1788.238734][T23716] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1788.290392][T23738] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1788.298719][T23738] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1788.316273][T23738] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1788.324360][T23738] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:12:20 executing program 2: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x3) 03:12:20 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000273000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:20 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100000c4500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:20 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:20 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x6c00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:20 executing program 1: syz_io_uring_setup(0x6827, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x0, 0x8000000}, &(0x7f0000003000/0x2000)=nil, &(0x7f0000004000/0x3000)=nil, 0x0, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f00000098c0)=[{{0x0, 0x0, &(0x7f0000003940)=[{&(0x7f0000002900)="1c5f7c4a9bdb2203cf740d0932fd6fb908b95d501f0f2b9b12b414a9730a5c78511513c691f11909c628b7c64d0584492dc71a5d7cd455c2b1e6a75807ffecd76aa7d108b4ef6b685f6208ca2819cd5a4f8e803e6d12ccf234c84cf52c93651f1816d96c1d2989e7f8bb4127a22f0f050f9509084d31b572658b3d48d93bb18758cee34d635a03766484e4e1f13ee23eef298aba1cc0487b56be7ed519f517ede43d0a56ddaf2c0fffcd30d1fb32a452a0ec3a37b65616471ff170d396ac22acec690cc7c9157c175f406219b780515171d8e7b7de5ed2c6f5530171b204ffb30b8eaab5ff48710f21dc6a4f3920cd5badb95d2a6cbde757c3d12a4c313ac86cc6adcc95b60b3423696edb1d43caeb9817d0ef06045ae627bc0ea5db13a3c88cbe565490f32ede7471183dede0a593b064f22e3769fdd9a819b153a8d3d7f518a28c3f019fcd71595364682960b7d6c5fc3042be8859fd22fd0db8d1befea2553ab9034cb4a6ad122f6f727b8c4f2c408e11a0fc7e6f15fe62ccebc05231a5181859e2e94279df5271239e2edfa5499bdc49e82412851f5225c4d5968b150fbb34a495ca52d71296f2e08fbbb7bc879dd4775724fdb04351918b14619fc038a604763c5200033964df5d718bd76e3fc322c8575876146a10668d70e84c83958b97bf07713ff1fe4a1216d2722ebdc5930474043f026760f373fce8acf66607f70ee42a2099c19f7a8036bc2cc35cc678cc925099e63aa457bc9deb4ac74c979d659c02c4fb8b9977a6a9bc4a78e757e7700bf34c801a69c397f8dbcd4f95edeac0c804a3a2f4a3f92bb88004957c8e9819ce0eee0818e858adb8a4b200952bf224787bde9aaa5dcc970b16ebce2db7ab0f9809235bdf41bfc64419e685e9c77d56a1d732ee9779db26199338c6d77ad3e032b75ebe973b9138197ba62ecb7db443ad519c137dee7fb52d8ffdb0596f5e49b4e202dd1eca465e3fd6bc4f1cdca0b4aee3754d87983c0cd2b2b691afc6483c0d7e8a84b5769fef1da54bc789f697910615bab3798ace944a6f61272fc284b4217a2332886d550990ecec6746aba9d10fcbe1ee2e7760c1a4cde3de9ab8a7e4481ce077b008bf6bf00952d8e609b3e2d95919af635104981fb7a3ca199e09764c53e122ce518ecba81a6f4e789a63761bc0f394f1298aa0014715ee1df19ba31ef37160894b66ca5504b23e5ee85546e563c5fa3c3b51c688d6e87dec2d42c3137f803880d119da3ce62a8e97ba76026328fd513a53b3d80432fa8b19992b7085d8412fc740928d7ac26610bbf01d601f34562c30f08ff6a043db5e049079e4856cdaf5109feb8c6dff4dfc52aeaa174c0196a98a31fab6d1ba630c7c5d6ab154aa61e56386fb08f79205e837c7dfa11ef6c0036307e7c28e4b85f11124d2e1792b2740d3cbb0936ae1fb7736eaf6294aecccfa441e5f35994ca4a8efe47f212933c892328008ecd5066da41641bc1d219b1ce4b014e81ddd7ce0c117a92b7c3931cf2e1973b792080703265fa435c87dbe92d3211863a59e1a492d140b9fd87a5ac25bf5e59d8788ad3e7bf515007fce3f8d320004cb9c8781c80f05d6b5e7967f4aff9e94f8efb2d29e35148a93dec6d87a0bd1f878c297875f11e67e2b82f5afa918bbfdeaacb4d2818f79045af475287b35d2c16b4b0e7e58e29f5309eb6e0e3d6e15889e489a53447189f7b5f16063068452dc37f6a358cd7bb3fdbd43216f5c76eb4af73ecfb73f4cd3fab30c898699f95e3fad149b3058dd620aa811587db5583ff53f013e357a516fc5678033163fa52e5280de22679154e79533ab0b4cc9ebc58a7c9e0c559cc0858f992d049e814f2b6e8cdb9f8b981c6a5f7dca9cab1fd15a4f0405c328436ab7af3a3292f4e448b9e80801026a2f32e8e4595743a1f01a407622f4918a8290d8beddaea35c49f1d255a642556c8cd8339df9499caeb63d3abf6fbca6d959ae18b8b98e41b02ead51a32d17a6569db7d31d00e031a7fb495d5fc321dd06d5d8ac49f44642e8439a42469eecf4c9c09f8114a779e7e6890580398cc050c0bcb6cbf49aef4f330879a9664f261e82d0309fcbbac971e09b87556cb773ddcde664362aff216c1ec196c99e23fc71c94359e6ff6a38e5cab66139f1cd27d7024114cd806ac746aeaae549cfebe0441a937ee2e8aaecec0d0c4f4419dfeedd7064e30392ad80aca2f5541cbf404d596f61181df041eed86683e5d52677846ea473cfe449009cc05daf83d942129351481a558e8990b45dba34b714697b72e2fde2651ddf0da3430f9c3439a0acbb413532727558df06e26bef7c71db417c48c211a31af0ba1ae4b892665223dc4c38879a71574335f3c010de48210835361faa7cfd5b08e67d9ec47a1c62c105613c2734eae44b216fa105443880dfcd269a3244b6b4819475b8741989094cd6134218cfc28d80db306e9933a70ea25501f9bcb8e5ba32a980a1ebec6d7fce2e4ffa3ddfcce361acf5d015377c94b44bd7cef359bc5d40f3e06060008822a43cdba630e4e068d76bd9d5831dbf6ee7178633888b1c7697da0a50f3915e2c7c108346abeb17e1c0d5cef00918e09e14fd100599bc3513d1fccb7572", 0x743}], 0x1}}], 0x1, 0x0) select(0x40, &(0x7f0000000200), 0x0, &(0x7f0000000280)={0x8}, 0x0) 03:12:20 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f000000010000000000000074000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1789.428115][T23752] loop5: detected capacity change from 0 to 16 [ 1789.431753][T23753] validate_nla: 30 callbacks suppressed [ 1789.431766][T23753] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1789.440228][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1789.440885][T23753] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1789.448692][T23754] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d 03:12:20 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x7400, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:20 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100000d4500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1789.478505][T23753] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1789.492175][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1789.500176][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1789.505884][T23760] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1789.522206][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1789.530391][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1789.581706][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1789.589716][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1789.600978][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1789.608965][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1789.631399][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1789.639773][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1789.650951][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1789.658943][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1789.694831][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1789.702879][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1789.718184][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1789.726196][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1789.740197][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1789.748240][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1789.760060][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1789.768070][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1789.780139][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1789.788156][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000015ec177b [ 1790.012267][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.020376][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1790.033124][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.041138][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1790.053654][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.061682][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1790.083154][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.091325][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 03:12:20 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000007a000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1790.107483][T23773] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1790.116210][T23773] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1790.118567][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.125491][T23773] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1790.132338][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1790.134332][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.141752][T23774] loop5: detected capacity change from 0 to 16 [ 1790.151584][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1790.163467][T23777] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1790.166416][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.192781][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1790.204368][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:12:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100000e4500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1790.212371][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1790.224143][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.232152][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1790.244001][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.252006][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 03:12:21 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000580)={&(0x7f0000000480), 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0xfffffffffffffec5, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x38}}, 0x0) [ 1790.263314][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.271382][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1790.283094][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.291066][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1790.302735][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.310856][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1790.330383][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.338434][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1790.350058][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:12:21 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) [ 1790.358084][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1790.369238][T23754] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.377224][T23754] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:21 executing program 2: rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x8000}) 03:12:21 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000018c000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000114500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:21 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) setrlimit(0x3, 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_getattr(0x0, &(0x7f0000000080)={0x38}, 0x38, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0) accept4(r2, 0x0, 0x0, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) r4 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, r5) [ 1790.483419][T23794] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 1790.497073][T23794] netlink: 'syz-executor.0': attribute type 4 has an invalid length. 03:12:21 executing program 1: syz_io_uring_setup(0x6827, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x0, 0x8000000}, &(0x7f0000003000/0x2000)=nil, &(0x7f0000004000/0x3000)=nil, 0x0, 0x0) select(0x40, &(0x7f0000000200), 0x0, &(0x7f0000000280)={0x8}, 0x0) 03:12:21 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000ffffff8c000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:21 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x7a00, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000124500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1790.624840][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1790.633463][T23795] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1790.661127][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:12:21 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000018d000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1790.669281][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1790.694008][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.702116][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 03:12:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000164500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1790.805342][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.813460][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1790.842930][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.851422][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1790.871472][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.880167][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1790.892042][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.900127][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1790.931164][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.939191][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1790.953819][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.961848][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1790.974694][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1790.982703][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1790.994265][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.002553][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1791.014914][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.022938][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000097832124 [ 1791.043558][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.051559][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1791.063085][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.071058][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 03:12:21 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000000ad000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1791.082215][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.090214][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1791.109193][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.117349][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1791.152164][T23830] loop5: detected capacity change from 0 to 16 [ 1791.157658][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.166350][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1791.178931][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.186985][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1791.198965][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.207085][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1791.219220][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.227252][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1791.239343][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.247347][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1791.259692][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.267833][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1791.279216][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.287246][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1791.298925][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.307122][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1791.318407][T23795] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.326438][T23795] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:12:22 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8cffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000174500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:22 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x8008, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:22 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f00000001000000000000edc0000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:22 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800007, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000200)='./bus\x00', 0x2a10, 0x4, &(0x7f00000023c0)=[{&(0x7f0000000240)="cf5f6c74dd60422c37c9fed0b7299c5eca3318c695ae10411bb29ad7cea49b8f3a3ec6ffe0054b2a83cdeb7a3ab099fc41c60b1245a268b24b21558622e282280f5390e390109c2a406e2750a04c4959d4a605fa701725555a9ab683d5acac1d084e8d2bd707e90b8a403b8444ae0f3ea1ab4b6a09e31e1afb4edb89b7e9433c65a1988fb1c42d897bfee39b0fd29ab64edc05c1ba50ee0f578a5913b4420a66a88cfb2819412b2928df0e0432641609a5bb226471f78acca453a9cdf8b449a0ffe78909d36076abdda239ad40444f286742", 0xd2}, {&(0x7f0000000340)="cbd24a2b678b3c6863546e0956f2734e08dc960ba2467dbc6cb9f0871a6e3c664a3e21a96cd73d7a0c190fd517c0176118c73919b9cdbef7ea30bec65b2b02bb7aaa04d8cd5941fe7a68d06980aa91b55bf97e5f94a00274a1f2bface816f11b34c96d8c026b44242f6d0ed6c9c257be27559c79fe6adfdc342be668e06007", 0x7f, 0x29}, {&(0x7f00000003c0)="1b84ee9ddce632b466ac255572c2567beecea87ffbbe97a9b2c67902e37d0d615d09f90f69d5a98cf2c618c86c7a33b7a8243fd07be7ba59a3de0853b0776a7e86d61d33f16b46e9986b405b42e75b35b34b090f10df9febeaa59d6325f647ab6b35d85f89dfbb41649fcf399eb897e4d5da29c68fad8283fa2c26efa41a2f3c1b0195f3e8c7c825a781fd60f6e860a9430a2d52e04ee5d8463d9a329c88bcc71f4a84484b1295167589b027b54c36ef2115cb19518007523d7a329a70302813525ad549ad35bd51bef497d5dd39035b7b909f6e4c82238f786d7d168c8c10a8a6fe100f3dff634a57fd5e7b184d2066a65fa77f2f7547fbbaf924fbe57247401e6163af66b1183034ae2409a093a98a225da0a138b4b4d650f5e6641b71a35bc61852766a75f94842ae083f0ef5c2b0ca10541b64f0f78c0f1bd66b584f0b4354d364aef7cc8807a2fdb3ae58aae882a3dc31b8e97441f296b6748fe86dbe621ebed6494b95234dfb294748ae90ff2aca8630263a1397a585a00571d22e6a5c125e5628a92bbd541eb07a03f465d4802b2a581f4cfb7b0b300e2a8a5c1e01a1d46d320d60e5804aee4fe3565501fab452ebeed8f2190b4a60158898b0bf209666ccf26d52fec14ca265e17411ed17611cdf89c9146db58824091fff601aa266b0ea99f560bfd12b6c0f78205d0a487d6197862a7e7965ae8878a6cb5256c72d80b535be3f47d75fc3f313dec8a36a3271dc28bedb696c92da3986f263e29123f3f2c7204cc96a10d0ce547b041ee5444e86c53a8c5b912e12b03a0aab521af21dd8e61edebcae1fe2ab94d4d5382b406f3a3b450fff64d861798480c134bc040791790d9e1b29a79fbc0ce7513ee8ac31c63ed208e33fd514742c2ac6bcf25d34c49699fbe4a0896c9d6971ec05e61281512fd10f6484603326032b7b5fe35b57485e498b92e5137770696c71b754b5eddd7d43ec00d06bf08bb3084c9cad66e92a4a77b8ad5a6fea2f4f275148a3f5718f92821bd582bb79c854858e412a3262b1d27190dc925d0a216916e7c1c3e570dd3d7a4346971869074215a919d167c7e6e0d23d1390da3838a05c188846e8424bcf863f479914daf58e830ef0b6bd8c4726d5f498bb2b86720f632c663d0db4926013a37059e27d4ee4e10715c78c435e950239f0a5e82b712b5357ccb8c052c457159325b7681906a679471d784aa1d2eaa2f6272f9986868225136bbfde61a733b2c253f2799d86202859f59aaec5843ca847022b82841cb43a20896dbc6e89dffb89f370afa44208c1c0f7493ae6e500279d986b275de7d45bd563e28637880147becc857ccaec0051d9301a7274c327c8d9104ecc9537d461994cc677ec1950858b4f53df10efa12156bba4b554c8b73baed82aa06bf3cb49ea63c2555dbbd01e6d0be8c36c34acc635e9629853a3eb9d5fc49186674c5d9716a3ce2353b5bed2eb485ef0f0c0d1501c381facb435b8228500933b79bc69a0702651d39c16103a42aa21df34a671707ececcedf84d88c1d2759bc5f1f66e42eb50922923ca89137c9f9f2e61d23c7eaa1ff938768783975d6b857b5c2ce46f1db24fea27c991c50b63b90ad20c78e607a58fb3d029c87f7c2c63c248f10225463e3ae8348abfc904d8303e32be26608d3a7b8a9454a7beb73813525a3817defaec37b875222b0f260271cda0e26796909267e918b196a063e7742538d6d35290c2dc4c39b29530ab18e66241c1629b1e8baafb3b83b34c692bd8c07d79608d273cce2507839ac79f33395dc66f1e46a8cebe199ebb055bb1531f6034d5a01d7d899e4f76d0e6d89e303081111b54aa33c30ab74e9e2d768046b7482040e72299c02e903c47b8d3f707bc0c04ce41f8e19b58b4846e87a017d5082c009ebd583142b33dcb35c8cc076a8d04cc330b175bbdb85a0f049cc6270c7ad766012e5506f1073c84460ec2def6806070eaaff360d46fdc314d9f855ec68e407ce270a44d44b24345313c6befd50ee1102cd30a3b0dcb7e47ca8cf9baaac15caf5e127e2c46fbce4fec6a3be36fa12c5901b25efc7337d98a5fc42137569bf75323077b015070c9904b6358f3556111ac59fe2c472a71a1d0755bdd33d79a6a7ef6fc82248b4718841b7e3d40dada7c02853a21857076b40b08aa38600b5a96459acbf4aa8a55f5a19f03c32837cfea4c34277a4d98fc13139e98c0e9ecfcc5b9e67ceef7fa3bf7d19f23b9c6d326c737c1623ddd3e768259f38366ac21a72800d0172c5ca4f0b570548df5acff997460ac64f34193da07e0b7d3279099f0f5502acb22ba2ae10b0fced6880e85fd6a9838514a8e259ebc713c6894c27232fa1cda8a2019b2a70bf24187e2307fa6c2e7ed52ee721932ab91cef20fe08b9b00d77e6ebf5acd37ef48d0dd099859d8222eebdcbc9d267f7255d283c7a669eafd593e71d0104c5d5ea21c24d084f1606e04cc090f20900341f258cbe0845718a903ae7f456b8213a62c8f3f5fb66315cd29a55689bda016dc6d2cd93575532c35b51a64350ebd29ecd73717d13ad1d8fa79ad315c8612746da6383f66ab9c5d08c02086b83c2ae435c6a9cf43d8d04e3e871c819b79a1f5767a85ec8de49e93a341984f897aac647d05f3bb229ae57f6e971f17c0fb1bbd8e7075b03f48cc5fcd4a01cae17ce0e350d7c78f7157c01b0210a5d5fee6c5e12faa3d4557cfc6cd1dab7f5aeb0abcb6da042a10609b7e7f37c85ed26cbb72672c7a7ae29eb738aba660a44683302656fee0599afa7a6e906834e396ca7d122746f3e597051612313f235d41e3ada56203b8649462be26c95be80831d1a580288eac42a282971231dc5074715753d3d449722fc4bbb5933829d6d7b8ba5337005b70b888f90977c0c42c3b2382d0b86e65c9d767bda516808637687960a84596b44b9c584e27d5c92c1e812832acf7dc05b90a9033bc0dae0961bf4dcee3adccb4aa2187021a733acc34849fa626c1ba7a92f8c22d67bf1b96297bbad4faf1617086b02b1b2ef47cc5096213c14b50105f2e7439d97718b6ac01717b187978f4f7ef6f87785d5386d4e98c93ccf921bcb3cfcdf60b2bf68e05df0dbd3829803e0fce8791bc8243a67f07df8b2e11ac28d78008708e9e50ac0c53c49788170b2d37b5b3802a936a63e192ff0651f45e1e3714ca6ea58a137dc97775a7cf084b62d44021f857d5f120e63573294b844c8b1bd03424d2023dd519caa263e470867e6517643fa547519410a8459612878a26482c4ec22153e19aeeb009f7c1a94f2bc4384d9f0e279014d9c4a8388aac05a439d0706ddd408743cdf8289049c3b038ce5d85ea158ad5b7b1b7e104b850f753f844ea813d66304164718a0d5c463c9e27a76c2e388194f5d1b18db1c99224dd38a79d8265ed06eff5723abe9ad3bfbeb7976ddbe576d42077cc882ab8425dadbaa1beb36048ab910ef16b280d6eef973638bb5bdba9be99cf9e2e9737e58dfe440289aa2ba202b23e9e1e9f8649ce3a994d3147b85bfe1ef60d1ea61468fb5c05fe4424d7ebae6d738668feec16d68ec8755a213d6c58312949d260b28bbe2566fe518294d65428e94408e0e4beeb790596b2d3dc0aaee436bd1026930ac7845fbeb15fb913d7b9c9f43e101325afd0192ec353d8348420bd4bf1eca5660b52e428cdaf5d35f0ebfde2f67add0ad594517b72f304f071649442697fe41c97f9aafe2241a0a9c3ff8d88709b58ef5052c4b1cde38ab526f46d9f950ddd15b5a267ff0e29d34f011a2c392aee590f28d828d4ffeca93bb6320e769a6d6b91afc477c227a097f324dd823619560d660f1258dc28c0ced38377c69290114ece2869292ffbe9c29ac555c34b5903922946fd84f52da5d8201ec7bba1b2e0ead65a2d680d870bbed112aa1f688936208d5df24b7485bd822b728356001a34f70dd3895d966b654c33fa5e1136060a8a33cacdf4ed8f0d04d87dd42fc8cf37f190e6c2f90d0641712db7bb38fb55983d9f38fe39133fdcf32476b94cc9fb8f047243e7e5e39c69ddecb24d9833f3c0f5f1c9df93052025854e56d721710b42fe2a95f06485a044f642c58a2e37a54df06a9bfc110f3dc788f13dd4a7d31f8323e216997f1273ee366c4f14a4779756b62d4079dab49e1d506463dbded571b49a5eb362a89941dc2c317e832b3607e4301bc97e22fdac3d2b6daad595633bd2a604b90756425d6626fe15e7e950a0ec588b6c5011955e336a568f960751fc2295b6067fa422779392de0f1439f65f4db3aa9412c5d6e86c8193f28977a89241797e3b17930928e6062dbd8074c12827a3e6a509c219f1460f0bcdcafd3fce3ef018310ed07e97bbb0068abb734e685681c0cb7f102b55bf9c6f4baec956a26a0138fb3efd7e3717c8a291ea3fb4c7e7a6db000b5c4004dad5361edb966a93a54cb3172fdee488b5fbd9763f1b2952f000e9a39b8717587c4fa527fc483e5d3958b8effbbbc36ff7db60ab07c9e5e333a8d3b32fc742654c23ba8d0d6096633dbdc28024a2a864fb52414f61bed5504fbf6ff304dd1b8c46cc9e9513c594b5eb01c815747d443e4de6ee6c375e05ff93c2f7577eb82326e81b4df382877e5e7e020e2dd44f1fbf32826c70bccf323f5531be8e2f53a40f21ce48111d8bd463cbde636e0cd4ec768060a67074c090fea0a7889093f3bbcaf6b98aa5831205d376f6cb50cf39bd02b3e1d4619116564360673615b603fd236fdbcfce465c262e532ddcee348d97371490af1a6b17528dc3f75e2b46b2833cba423a25e8ea5ae9bff479655ea2c8a5510ed0942f129d751ed916810b1d6ef28c8d79aea608eb604381e7ac9da98e58caa9076060f89ed79bd891b7280efb9f621b5219f7d0c475e7a5ecba981363ac4338d50825405457582e86a2132ac3cde94aa81870d2c9174e7a5460578a7e5f82899229c44a6be2a6559cc42784bb0cc73e24c3130a7d892276d890d6902c125c546b6198f91fd515ab42870888ed3d1096e6474f9141e6d9b4e52037c895813c524dcb3c5492b894e6a8e29109812aa2ed0a7c06d8fc63a5a4618fe7d65122f1f5cf728ed4b3f12c02621c616497f16c0a706b68e21279d8166eb5bad97b90b54eebe4083cbc73e2fec2eeb30a7504b8a782399113aa9306413276be50db6943e700ba9aa912818ca599832777930fb55cdb9a916fe0dc65360a245189b429a293173522f57041e1044d67bcc9ff4df53af4b629b79a08d8d4d3cfb4a746126704ac3c59ac97ab1bc3a5f717d9183d817957b09f90d4f9a30c45b680f7b278c9c3c0e8349924ba18381df0e76ee3faaf27b18f7203a8a53b5e459880eaf3b2e827e92b8cf9eeb031f529085819f6793517e279c22e5d5c92d72b6729b0ece98f52e5480524e190a649a7eafe5255dc4edae86091d10a7eb95cfc1d5fd648ce11905a42da0cd790259cfbdf480bfc393e3ee851fa0d3331f43a2f376b8124ca74d97b2d3b9a2168ab97a59d095fe89c5ffe5f096fdca08752466ccec3a081f5645e18f7f922114a3b8fd2c66a7a1bd223ce8c84cda07d897758f669bce57a47f08abd6db0e8b241449b4cc1284fac240472615e924824c46ebef281f5540013dea4555fcd7b445d0037ff1a8237e40055a22a9426b39557a094280399e07e694b510d86c33d05f2d3b98e50d3eee93f05427267f01ffa683c00e5bb9a76c7ada4b788118710da437dcc156ea67b8956cd3a41e1fc516fd5551dafc21bbbc539b20b1f07ba1685b68a197a3f92ec", 0x1000}, {&(0x7f00000013c0)="cf3c300bfaaaff747cb2d766e104acaafdb3b0d4562123a21ae30f0d36546e4d5895fa06fe2dd270751d598daaa0814b19e348dc37c238bf59be35605b20cabe7c81fb1d90b7dd669fe024efacca9c5d0294346efa28fed845ca23e36edb1ed0f685b7ef9d1fba9dbb9d0cc7f2401b588092a98bda7457ce54d7e75161f5254fc3628b58b251079aa4e06273ef56699a4ebb07c230aca58c6a58b9bb61dde673780f4b9f32adbe6b5da027e7555cc53e393521fc3a174f7b2def34c527ec9ff5a3196a28dededfda88178cd21d78945d6161dc6d8968a28499c3bde8986db1c92218b317519cc915ec8ef15a79779a8d94fd8a98fb15c79b34f946b209bbbf978e1029c3d0cffa3645644799f420a0f03f89546928eb926e577661ff177076af52a2ee0e19eea20e95cccb36f762e1683b09c7ef2f0685eb66ee5370702362afa9767520089febe8ac424e8745a326efa00d2745c57bb52fbb7c2fffd80c5c6d67804e916b1888d42014dcb43eb0b52ba886ab54eb7c67c59af4db4ab0443a298cb286e4bb11e0d9f21e4bc0cd8e30c0712c0d22fe505b6682413f61d3f8c6463bd60d4d2fff70450d60bc17d359d70984c24bda72f917398630c4f574d92a65bcc3ad7af3a3d435f674e0be83949d88a8e55d06759f072e86ac1cfe347b0adc8125cf9a5f0b5df685ada2613df83a2d0e8019ea176c1e01f9ede393850e9d4e23eb9d1fc1ffafa71a9e4598c08f7ffc9d81e3e35120a2e820846a8a0c5b11bfeaa8c6554ee4860836051b188729f8868a9620bb2387951d98ec9a0678d95e32d7115ee59ff22241b09fa05e9078dd79355f018f9b4731d867827587f39cbef52bd01822efc5ef32e192e2100384b759211754a5b28fbaa2b72f221208acfe0ec0a28ca981bdeddde3f38285ea318f540cd58fbda6f3d13998277ea6e1974dad416d4a9edadbb6fa47a730eb2b6f56c8db6f4508752dd7b61031442af3f229cd8e3cb2e8fa2c97d2d692f7b6369032abf7654f88ee4b71280cddc642b4a8e461ea343d10587c3aac0fe9200c559e16599888e800470597c74e3e69033f246cb23c591f4c98d6d77ca221d539f04a4cd78344e8d836107bdc974e646c856085221607aac1c230fa2a00ad578802a0b87221c6164fbdf06820cbf3eeb38638f31a9f3dae7258ed9d82ac8946137d1266f22f62aa5afb668d573af752a91a50106c8a5f22d15e957e763dae1c69a8938cfe7f8039410e813347a94392fa8179340afb10256e93549d506f83661a74e91439178891bcb007a853cb3764f2a84de139ca82f6975c91dc7d7be7afc44a0787edbb69b30f198f0a717776a608f887ddbd492901b121fe02f7caece582dba81dd2543a909d6561f131c6b2dca7fa70babe5d7d4a0b9ace246447589e93d1e469568ef7573b60b3e2bced4e4bf3041be55130a6d517ffb74ba4280a563c5c172df07587349145af0f5dac66174a121bb0089b31bfdb7c0a467151770ce70123e82e08740e1f61c95f81d71cac8c030c7c3998f061755b1ae6eecd6d542cacc166019ab828c5de77ef976f8f1dcb211b6189ddcd816b5aaa0ea7f5808f1239994caded6d4273f2007e9ffba73928c5b95376a645d58825948a694cc45c19247900bea01ccc49f52872353c0989def3d21cec4a766d31aed24859f36b95f56a86c71698cc1191df8d6a4300f06ea26008fdb2bed38ca2d508c2ec045987a98dafe1fed49eceb340dba0b927edfeee2fd9b6de74e1e3115a523ed5254937c7d98ac5c693ec3bf0fe6b07bd8cc6ff7f2b1e92abc3d895311617ae29641e3976625ae4c0c175af4b45d76d5bd56d34492f86e4bc2c276f2ebddd82e6f0a41d4dda45c6a76eebb9ad26ee33524f18bac090e684d2624584669b9b756f6bf729012b196515c280f1a87af2e2342c367194511874a25bba04c09cb6f392b844c90e166ef3e4cec5a5b77cd587a5f659ed1572bebc62b5972f04a4ed2b7f4c52303bc97d2b743dbc9593788eb4565c3b78e2521794a0fc4e8e243792aa1ebe831d06f15ac54b4ef5d068983c2983504515b0457af35176bb9d6f265d04a7f21d5a1736ed067c33f8159a2409506b3097540823c2badc0efa0c6208dd2c103c8e0772d84413cd67069d931903a60a0c8a3be015bac3904989849782dbe983a43b8b4986b20c4d1477e8afc1218825a00a2731fe40182deac226d04947ce3847bbef10f14d5838f7bdc5d590af0e4998cd4c17be94032425b8f6537c4b527babedac8ba5f93c12cab981e51a7d5863bdb6eb2e1c106a95bb9798f060c6970b3f8273ceab7e09e92a8f4b4a70ac13a0f8cf8edb29c6778e168da121c2c246d91d0240ee385bedc4d6c3b691ce046f029cf8df334745b7c4659f32f0ad5f7c82c4b16725a4b9182e5824146d9b27291aaedc4f3f2253e3a218cf602a13a6e31e03df584e4a9227e0bfb82f9070a5fc004f2b461fd08964adc208803b2faf739d2f8cb1788223815af9da44028b7b12681ac66cfa45f4315e43d4384c66625c9975a27fa667dcd15c5c5a1a6325ec1fea7413deec518365ca21a01abdb8830d8d7f27b4b5e1df3eecccb97666abea01f62546a91feaa82ccd19dacf1f27cf843492d09425a2835b971060a8f5bf8409de41aa6cd7a938a400ea60eb98fcc8a7bc81f72d4d8900d02b0b6ae3ddc7ce216d7874cba354903b36119abe0927f2920344161d6920f06ee57acf3bc80ff61595f1d7c3d1d5bc2d4f0a5b29522c4373dbfac5fa0a4dad5a7a445647ade39094a9b93546b83e185b73e95de5b0238fb9e25e77ea65ad1538b268be87dd009a4cda78f0f4cb0d06f5dd78eebcd37d9c2449537f670f9dfcfda26a589cf9c9e305d0d8a76f049016c37da987ff7c95369ad1eb37cd5e540a3f7f53143dd0888fe5acdf8b52c5205a2d4717faca41c02a941208ce2a14d9580098c2363b3ec608ee3d24d330d7779bbc4de7d81b7e44d7fb3e842db98164fd7693d4b76ee822cdda91beceb0aae06514a42194f72bd1a907ad1accf3f38ab585b977d20facb985ee48c7a8292b8ea12ebaee323a2d25960669286884bdf0adc932f4d66f4fb9363c2bd0912ddbfd2414939e7023b7146271c0839d6269ca12cff8098c4043cf85a63191e5f3161ab7431612dc46a7737a9bd32b2d03f2374701860334a8555d372fb2b2ed53132c24a44e4009df4a9f467469ddb9df2c26facbcca02f7f8bd8ed9ec04232b3ae5555c062419c4949584666c98140cc13bda9451ca2bef49aa3bf5049ad3b77efb138ad584fb43f50766caee98c37d99d58483aec00468a3be7bd2ae43d4eeefa9e3d05c3a143716aee39a51ecad54cb2fbf8f6b5282cdba7fa56401504f127fe76955bba670c04d54a7e6750333e741786b2c170ff3cf81d17f0937bc0f9b84577ef80a75a9190c730c7126e707b5d0a0bcc8efa746499e617268c2cafd2876e661c7ae30dc3f6961e3e6acffb65b7cf5f59bb24f34766e23c1d41b36bf0750ba16f12b958f5243d0c77412828bf337c17ebe34e80f5ba0e7595e71348f7d05882737e1320c23ecf48f03b74c8cf5674049a0a1e1d7bd2ef41b5dc6541a18ab4e9544ad627c981acce4cc899853c3c005cb0cf05b8884a2cd9edef20fec8f90a2b181d2e7a876f18295da1aec098a02404e9eb1516d7913febc24627d98003e6a44d25b3dbbd1a08d70b077d63a45e8cf79bdf6f1b3d3c3b4ef3097dc63ad9dcc8bf759f3d27a870dd94272c4dd14f7c09b614afcea5dc8d65302b46db86039571b4f9d96ac97db947ac029c4aeb0e929d778843dd95d056cf1e053741a052d4a6c81975d38fe3ddbe126411596954eb6bdcb04e9b7cab1864f8cf299dac10973573fddcb9eb72378c43ca5b805fe3ffc127298a8c67a1dec2fbbf09d051eac11d45a6d181bb22dfa57cfe107bccb4c1054ca672e98f11f705841b0c05f6aa5498182da88f4033e652b2766003a30a55c6b84c5462680d5131757d597f795357b89fc6e1e2ff30bda674c01a4d02ba31522d9e206222ddcc4f5910549b14abcc49a8382b1ff62131865f2c24e0b9ad29e06f19c6e25b48f3f576cc49b01753b3e2b8fe200c64879481b4bc8bbe934d96850ddc185e32c14c302dddd567c4c001b4b60e64630df552f91319b77eb4235cdeaca1fa20f5046576729040eb38e5accfa33a2a864fffbf90753dd00d8e534ecd9c7d42a1ae37dd33ff2869028168ca81c796185a9f51f697cb48036712c49649f7e3fc18b1088a281fbe8b5539a45bef41ce831c1c2fd2a6d56930842e5cf68eab401a351aa23a0632a9aee2023b1add802fb436df26303570541772bdc609ad543d21eff6236f039366e15079afacc4d972a44987a51ac8739da518b2f56b429bee47d79c0ea6538e8808121e5a3ca5d140bfe2a1f225bc8bcdd923f288af6753c755a7f1e662e762c46dc56a6d977e2a4541906307163fbd0f5285ed17b063b1bdb7a95690618171d4bb54b79e79afa33c569fcd4aebaad1dc9e6d07e9c5eba0cc253bf44de015403bf238819ac7a904607cb73bfddb717deff3e549c5dd48af125668c28b4db29af3030ae76a1b0d433cbb694a1f14725b2b763a52fd7181957665bd372cb626c31224896ba7364b43d04ec6966b50362abc097664cb42d27884ac19ed73fef1ac0caad0d70302bea82113aa19f7614d6b43021737eea7f78ecfca30e1f88b290499f1c48254fb7cab31f70c622dafb3ceefe641347871d3ee64ff0ceb656715887c6ef7037412b0e86d7003f97cb323519f03d5c6df60884b442a4ff498f7aad897d3d0ce4621c894fb5696dbd838155dc3c811cfc03450ca7fa8a99db4398cbd178ecbd944cf4f2a939fb6da1437d6428c22bd0ee9f0a64ec39f787c999a44ba2578b219d4326d23cbeb1b5c26d33f42641bace6ab7b37c3ca42d8ff2ff3523dc7a00b38fda79546d01ebaef570d026e25b196587ef029e95b9aed2b964f414f30923afb54b2278ffad973b28a26ca3f7a90d8adc785e3ec3df143cbfce1c2c66ba7425c109be50da20bfb18ac04732e7c1a382325d09f3ceac2c2e1f62b6075d446837f026f6e8ea6296982d790567207000388189ef360a84aa915ec56cf725a451fe68f68b2a272811c3bbd0b3c7eb8009c53fa02bef002a38aa53483e5ccff810610e1bde0b8007a0a7524cd68fef0099096d7f47605b5eb4cb94bdbcc7b3f1341c07c850ec26fc82f4fb77dac2a633041c144876b3e716b3bc48167c55e4b9e40184b8ec2e70ea6406aa256251293496a3bc93b85347973dd01bf0d3604af2986197d29a67d045aa6df166fb061904d8d22e8605952fd7a744a51d97ed72a7a6934d12d946540fb68381740211dee9d9a23c04052f3b435cec0929f660532b2127375718a4369f52d41a76d5fb2ba50f0073a594af8630bcd87665e9e66328701a33f3313dcf7540de2f568868beb0e9981f08305e5f463609639fe536996916cabbe64e1c4af6ee1146522808b7bd1a9ea2861e0374e8b6e903aaeb8492989d89f55b8aadf04adbc810681ee28cf17b9f4b8d94baf83305c03004dd201f0b48be592549fa7fcc14d7a69feaabb618047ba31507372c27cb395b6cd0528985a33b6d3f570d8ae7465b878a4b8646121651f79d4da07125d9ad8624c2fbde66317b15d91d0818b0f4fb53ad46bf9cdc1f9464ecef42525aef85b19a22cc8f05c26d2f2388aedf1b4548982271c0bf9e7885225787c5704b87702d35bfb4795a1b76f562d631ddfd0", 0x1000}], 0x200010, &(0x7f0000002440)={[{@noacl}, {@barrier}, {@test_dummy_encryption}, {@nobh}], [{@subj_role={'subj_role', 0x3d, '\x16}@.'}}, {@fsuuid={'fsuuid', 0x3d, {[0x66, 0x38, 0x61, 0x67, 0x33, 0x66, 0x54, 0x62], 0x2d, [0x33, 0x30, 0x32, 0x64], 0x2d, [0x33, 0x37, 0x64, 0x37], 0x2d, [0x64, 0x35, 0x37, 0x30], 0x2d, [0x8110b2810aadc9bb, 0x32, 0x53, 0x39, 0x62, 0x62, 0x36, 0x63]}}}, {@mask={'mask', 0x3d, 'MAY_READ'}}, {@smackfstransmute={'smackfstransmute', 0x3d, '%'}}]}) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$binfmt_elf64(r0, &(0x7f0000002640)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x8, 0x6, 0x7, 0x100, 0x2, 0x5, 0x0, 0x133, 0x40, 0x1a7, 0xff, 0x74, 0x38, 0x1, 0x1, 0xa0, 0x80}, [{0x3eaba5a6530e6015, 0x5, 0x7fff, 0x6, 0x40000000000, 0x100000000, 0x6, 0x3}, {0x6474e551, 0x9, 0x8000, 0x6, 0x3, 0x1, 0x7, 0x5}], "ec32e8c0566b6f9ffc08654a64b6d3b93c5c51c4ecd5aa6b8f38031c4170626ef11f593d744702d502e66371ea2037ba201a2a8640d09f5cea2027090f0ade20d30d78cc3bd4525c8d43457a9347bb5233993bc2b12b55c9b3c63fcf53dfa1eab47ddeee66e92ce8f160ca362570bee6f179a9ace7880f5a79a8baef72e7991d866688b655f3a8b139117b5deeece0720c266dc4a353efee46e5dabb50e8a7873aadf7ad4b979ab2daa9d9f51352e914eb741b1e3adfc6d323292980d315e1e1f0f2df9aea470c27a0f891a3eb98c782bd7a6def2b4f1ac9d161d90f6afb093e69dbf57c2c68c5127337b3eb1df18a35667447f72dd89be49a564ef248d16853dabbd3eb1009dbf607a05169cbc369253ff070b6bac5aba2d09e5885ff58f1b0af64453df7aa0364f19ea8875f8b147e039ffc8da1d6f50045f8dbf814b1aeea678711edf593675bc0118719e3fcbe12b42acd52cf2f11f6e013f98d6c391ff5236b0a40c332922cec98b824c33197138ba8c89d189b965aa183463db15e8a57224eea62934fba5637d33494718eba58c351b1a77ccced97570ca901cbc6b67a04137618d1b2d565baa3763ea8a5e55760007a87a57eb5050c3721d54d41cbbe0533fa82c874df9ab40c89b37f1839fb3ae9616e2beb238cd37c5a6e34a86a19858750ffe4d34732af668c12bf971c130a4e3631f00c5036607c595180a85ad63479b43f35aed64c91c325ab5c27efff372d0f7940c853a5238cac199e59ec11b063fae138c6a760478b83129ae28cd2fb053ee9791c6f6b77c2a47b16705d1ff835b40c4906dce131c9c9c8e2c35a32059b79f4befe67ef9a2a1de36d1e80ab449ceb23be3ece0efe465d5d443ff25b517430f6156d9e2265f0b5f99526a08832e4e63de51a71994105f5315de919ab724cd52a3233aba4765fdd449f4faf8d653b1eed7bcf297ada9c873c498619e91340d52844267c882bf973c91d4a909ad53feee071d167a665d66d46460b28bd38afdfe10bd7cf59426ffbfb9b1836bf62c29fb661d39c5d9e4eda485b141b763ff24cf452d3c18e178a22dcfa661e57c101fb82c98bbf2ae03a716da46abd454a4f98ef1ffc82f975ba44f9c13e09dff216c8fac04cf0f49eb52f98b166dca98c1d522630529079c2209bee0ea321f6adf1826b513e2ee3a22baec16ca0a5c493402ce1e4e5ea773780bc11994b1635edd88689fd9af46e8feb94e9a6d744bf9cb553a6e869e19eac57cb5db535f0a2bf97b228a018d190c00d781485aaa4a3282f728713da1ab6911cfe09e20cd481328339cabd998e6cb6fd78c1415e6163b8338ded1c8dc50a8dd429f375687b3c551d80995bd6536921e31d37fbb55d1b439edd077c072c0929ac131fa5d1634a0c23117231c62d062c77046d8a5571f910136a1c834f6af46a4750a60f118f1f8ab60a1da727387b318dc8cb82e0be7f573c89a1007e90cb620110bfaf7029c37845d26064ff973705fe6ec411fb3a43c95484f4e5e4d9c371f82464411b7f6130dc1c37f9778440e04e335a852bb62b44e3227277a2758e5ffb7d2e6ac777da3e487f6290ba317b3b5d2c1938884a4d63fd52c652514018fb3c05334292e8f52396968b6d90c9292a306a653f4207eca8fe802c441083485265898e85e3c99cd9dd3bbc8defbc4c805be4e0cc3d3ed91dac78f8c925892897d3e0e5dfc109a600a4564b2ceb9cc350eb326e3368c4cdb185149506faf9b859d7ddb35d9b3d900029dbc221eda16d0f1edd7009bf7dd597e14e44a5dd6ba3650abca4bc39e3d7342f01e6ebadc94590f184992c28fba35f5fde4e4423b06474a556e615127b93bf461dfa736825f6a2d04857cbd72d61725826de373358d9a701fa09dc48bb9c06680be6c7824278124c417f795c92bf537cd16f0bba059cca022b2ec1a482782d4065ecfe37cd55c8d0682199280cc12ad6379f5e13b3a7367f56ed5842683d642bf713134246decd2bd5b7991f3b751275bcc6defd098b4ac61f78086139b5dd2a69d26b72f326740127f62f2aa75ddc06bf20a17867f4cd3d6c7e2be3722cb2a4357693bd9319142cbc87bc2481a55c534a3fb50e8a491b1c48e8a3240b836464aeb5aed78abac6d2eb625d013f66c072b0ee9c3ca4338a0d27c07cdd41b059d0ac0bde344921a1ddcbfd021e9c9c0ac21c1d74b1b75719bae5fa02a76450c1dff93a25978cd24792dc529b732dbe329c4d9a029f714ea2b5efee282e22398584cb58a565398551ab6e845f4e41cbb070858f353276acc062f25091087c1c755e9a78974435372993cdad0f8024dab4b7e2666b8e022f57d9901792c2eb8506fc369b9ef54ab9a6a44468e992853192e820ddf8ed06b7d7f28f16d219806c512fadb63e633deada7e21a4a3bf8d7e99009de174e0015321f13092bda605e5a65c6850dad3f4a251f956a5077631d629046b87c8d3d58f55195fff1aa519a43cf2dfb7d07e37b4798581882aaa10b382e490f3c53220dd1f4f607145279e1843fc2f3ede5889258e6feef4fdbbb75e5cd2c97531675de1f582c3abbe0cc59d40610d4908107508424b281962c67416d6d575ff341f50e6a9254539edd9042ee80d5e6f87a40c806d7f26f9ada604b91bd3c8713510089f8f0d502bbd432576fab156713cff77079e45fc1e788cacdb7c53addf9c47a8aadd8079e3bf8b14e320d2b155ce9084a5ff9f305befc0245ede2ddb6ecff6cff2bba0ae20b0a42e8c9a9dcfe7603a6518031871087265d8d4e9239fb87044ff08ec05ace2492638bbbeffec9b184136ca248a13c9bac9682fbbdefbc7638e7b2a22a7e7aee770b4950221187eca0eb2a3ba2bd1f91e561a2c1af9b9bdb4da0a827b98fd8ae96360eddeebb6fb65b95895de4645909bed857b1f031cd1b7454c5662fbed1ad870e76a0291485c32c480710db20980cf40b121f18aa0c358925990258a33cb3d6e4ad97a848b24d7bfd916b89587a23b2d3fc5a098fcfbac2cd7968e9540a3d7ef565e8ac7dfa6a57f32a97d5b0a53495adf303817ceca22f45691c2843ffec6dddc6dbb758ed377281aef3cb9d21556ed4946806e6cb3f540df265aef8e598a11faa9e2a98680d4097c219d29240e6ff170defc202d0419d6e7267bf5690311ee824d33849c36fca67c299bb9b2bc636d00ed72a165572a1b708da3b4a2a58ba64f6f2cf27999bdae4821cf660fd0416da1477e22ff106cd0c589954941a3139fc26c5cc7aff721f2c4e5009c3da14a77e1f9ed7bcd2bdc660c7a860fd80236a1d22bd78753f6a4ace89d4fb9a0f5910a46106f6d19102f0854d68b6cb22425e8e4ed14d04171428f47d315a6135e764d21ccbd0a775057f89cf8661906cdc9da4683c1d0d7da54365166057d8a3e5e8e4db230533c100e0361272c4006c95f0ff71f914661d7da97fd99ddea9da2c53bf3b3433175c2f2c70ec31482f3c0ee5b1b3153dedef45702c04ca681e83bff8ecb157caa1bbb91dca80c2eee55e25194686b9053916a0391de866b7714e290bdcaffa1e063387ea45159aa149c7247775121bf23f734e7aec0702dd30f9266af042d9d076148908ca003c27e87c0746ff93ce54d095f4bd2e9c9a20752b409eb73ac8ffb7f1f3b21fab0eaac7f86c78232a0f8da17e56d1231300599d893cc9fd18e09d34fb78520d60a4537688865469f493287ece31fe2ac0e015c66d17a4015ffe6cd8ef64b4c12c26c1331fcc2d63bffb87406dd09b08d7b3faba9a2bb4e556587dea18f20a08cb461f39762ae46f9504479af6fd58e756ed935c0d5091030e8a93209b96a3428222411b6db100f146e38cf554c81ccdec7589c242eed2e20bcca4fda8b202f984fe2e624bf2b55ec55dc5b51c13bc386266739419f3c31c5a0835e1db45e5a22a00bab76dac06d2b86752fb4db6098948d127c2af35f91bdd1902cd7ec74c6d51b5fbb2c99a36059e6d7238835510dad3e2de78df6b2e44ef65c1252233633f864bf0c0b63a38c39a7302b327bc6b74a956a9d68e2f4c86fa4425e324101dda0d4e4a83f643a1c0efd81836d0c65cd41a6715507a9f5078d1e6b319858b4e56c4257430079703dac71c695c4afe81032125faab47c74a4cf297b85a0e244162b138a18aee0438e7a2deddad5463b093edc6e02e8296cf55768be5d89df77296501db8b5ae6beeefe45b8eba34b49b1083ec9376f2d2931dbd178af1fad451ec444e05f6aee0934b2e28ca22a2ec172969ecc6c24834e78081da8196b5fc49ceab2676d02a0ae345056e7e436f84c5cf3008ba94d3b15b3206fb7eaf2a7a36f5ca90f053d184e7ac210b06e202fee35137c9c47f72c286e75d591f2df1912fa19dc2c82c9de8b1a50de4aee7c55b514ba64dcd3ee9b216d8bdb879464b0201710f4aa060fb05946e92fc839921aefc24dcea8f43aa5133e4aab05e3cbfe9906d00425f8157c19ef43726c7490e32b9dae0e4aaaf70a65e4e93c6c46b5ffd0e2c01dbedf317cfea645c803926b0df5754630ad63ab7b7f141c83003d925a6612138314d68a4e6f0c3e89efab41a9c12437675e425cd426d3ede51247e1ef985b747551fb343204643193467f8d295dd29a04f08a01253c5e9939c12d314acf4e27f89263cfd3ca47c94c96578840ee390bc4e828430cb1df1dfa88f09ea02d747e181141845d4a2a22583e0d3774738137b54634342b476f378d5f8af9415e8784f562c107228114c45231e2b31adc982081156d21060f50bbd33d67a2dbafd8b5c50f53aeaf084cf3000a3c6fc449b4a52271d4fa6f411617795ba02606e1c5ddad89d58ede066d2521ce8e181d0b4744fdebb2eec76168e6a084be98c71723026e1b550d9a969e8b1a689ec27bb61b772bba27c125446e4b872635d36ceb964a2bd8edc7e5978d129e066e49f727a8b884d91b808055fc2ba9ba8704f58e2d668faa5ebbcd11d344b47bd6f6c9ffcb6ed41f0677a8d6d48dac19e662d13f88e6251c9f6b45b3b78c871496746c530d2b95fa7b8c3cc921af87a920370069533ae64f420e02fab024d6e52c3ce85236b2484f806fae8f26fc9a085eba7c9338c61814b0223d5ff952c32f8ab9bbb4f52650628745559b89316c6c9d4177b7c74b87ee180ed03a60a7a2b87460ef37a3d8406e5c8fc46328bbabebfde31334a65eb528aeed48ea0427c8e87ccf143bf4417af48101b64d7c42b614ada72a172423717fb4917ae2b147308f00134ddbd187df4209f12e08217913afcc4fe293c70f2231cad81b6c2d9e14c1b84fc32f3964f2201393db24e1381881d26ce3fdf7acde7dee989970996f971e4b6b2f933d3cb039a26920b1fb10b1fa31d6c7abc0e82db35082754e1c9c913e84f3574786b99389c71aea5ad03a8dc4a6f0da7e67913f6c85c9fc4908ab9f32eac9f825a1bb9828ac1635d5e896361dc61bd544c7ab034384b37312c0ba421a9587174f2d3cb7a316d65f9cf93313f161d48809dbedb8b3315b0f9d64d6c7c4f5dd30b1c28b33af3224c0af585a2f9356148e63b5bce982f3bad9ee8581fab8227157946c5ba4e95dd934b821918753e2bd2e9cc0eaa43cfba483cb11cf7499c7c884c338a639dea1bba1cb9d84849832dbc32590969732f0b8f97bfc22844f1f91999738ea81f62b3a193283a7f9b4e7bf30890de6eec7aef19948490307a699f0772a42f597906cb6f901573af355b712825295ab5706463dffbe3d167850bcad8ce223eba3557576c6e49aa3c2c712f1dfee91b2918150adb1786d6e41", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x1ab0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0x2812, r1, 0x0) lgetxattr(&(0x7f0000002500)='./bus\x00', &(0x7f0000002540)=@known='com.apple.system.Security\x00', &(0x7f0000002580)=""/170, 0xaa) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1081, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040)}, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$P9_RGETATTR(r1, &(0x7f0000000080)={0xa0}, 0xa0) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 03:12:22 executing program 1: syz_io_uring_setup(0x6827, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x0, 0x8000000}, &(0x7f0000003000/0x2000)=nil, &(0x7f0000004000/0x3000)=nil, 0x0, 0x0) select(0x40, &(0x7f0000000200), 0x0, &(0x7f0000000280)={0x8}, 0x0) 03:12:22 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000001d2000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000184500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:22 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x9700, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) [ 1791.579126][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1791.587459][T23854] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1791.599212][T23849] loop5: detected capacity change from 0 to 16 03:12:22 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000080), 0x7f, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x1) ioctl$FS_IOC_ENABLE_VERITY(r2, 0x40806685, &(0x7f00000000c0)={0x1, 0x2, 0x1000, 0xb2, &(0x7f0000000180)="9bca09ba2c8a47a06cd3297c67c7a0355358560e5b8a16288048aa65ce28953571e733406d24314dec7fe8fbf64784eba8db76be341f70d32e405ccf3e67c415fe0c6af1a14900ea1f8958739f048f5b8470550c9a392e0be4c1110c9d7123c2104c2b81513f0dfd7d3b11db3f7f4c0fc09551ed71f60172403cf9f9211367fdd104f3c1b51b2236a70e813332c63ff5ed1230e474241d5a4c907583fcfb25ca87da6fc9653e158b0017b44ec4089c4eb375", 0x1000, 0x0, &(0x7f0000000240)="99ab4887c9f46804ee54da75ed61f77545213850c6459f9f4054f1461d6d2d90e2f482ae657b16d520185284d3a5142cd293b185ef1467f19c102f166959f38576b9670bd0b193667394633b6a0860042b2419cc9642e3da3cdb88df4e1b8c307ba6e331ab571dd4ae4e59c9dc2070f9b65b51b645ee9a404d902774dd6dfd3cb62cdced1f6ab1f41be93f84d1888df30a07060a4b0777a5832e6f1941901d64b309ba2d391edf8bef32cc1327872c6b3732611ed622e695a74d107ac47e8690efa4e3c54130ef0bf141d7436fc776ad214e5ca2d3930e8784c923e753f7ad9ba4a1a3316031f38ac7329a9ad76f0a182d46aee19f7233b198bb0f6ec3d6134c304fe4ff9adf7dd388404288921707c3b13730cd20fcd02c297fea71a7de1af0f04244bca0e5d73836793e733c49a846c2669c7c624c3b475e2dfe404c8196ad741c96b82c8904de1cde05c6a7d510ec87cef45b6087c416b8093fba42b14560c3683a921c53f06fbc60c72b34c3925214154aa6f9bd48fcc24001eb4a2dce227123ca92b1538db2c3857c92cfca731c352bde4214564a081aa619a57bb501b5fd25a318175f97934535ca3a23fbbca7ac54768d56b686a72b2486256935e2b7825fb3a9c83bf10f2bdcbff8ad04ebabc13d9063ad3d273790dceab3b92efc951ef47c9dfea3d2754b9ac72f514599f79c8ec02c89d4d0f81a23b60befe40a4346382a70f3ac0fa4d55acc5c9a442853592ecd2011751ffc1f9700d7da7f88fec523776dc6191de3942750ef656993361227e9523ed3189d772c6751a320becc631db22cf2e548376c29b4d8b015e7d5c3001cae6d7a4e0c7b6b917b13c9bca998d055bd50c98cb36a937e2d1c39268a82fbb901d8bbf230c4aea6e4996154744797c4af220f93681415c5d4905f59a0b523a8b9a7184529c3f29be6ebc24fead69d36aff3a8bcbe9d7ee283addcba2dda16f13a5bfa3ad46ece141856af2c384e908622e5748a35f684ee6246da2e9812d315f898637b3e9f52509d65aa41a2d79d2aafcd5e314220cf61bc3b4622079d25ffc8a4764855a4bbb308c06fa94d0156bcfa4b695fbf2be636dd921c4f4175a8570093d941b6f2e6d590da21d517f73cf30e510081103ef7da709f512da94d21c54a00d4a0a1acb70ea3e7130538d7b6584a83315edfcf12c63fc0ad39eb1212fe529e2597e0f37c9878afc4621725a800b78dea4ed64dbdf324921b8c6de0c89d76b920f6b6325405250b362917ccc6b85ae6aff429aa0222e32d41a817dbe31426fb5e57f29512551255270dcebc4bdbd443abf76208c8b942bcfbafd7b8caf99737b8be75c7dd382435f23d7e9615a90d8e4b6af63435fa49dce802414e98367fdf2d704c76f770398f14fca0bcdc66c74c26163fc31ce42067d9c777cdb6df3f0618674ce93a75dd723dfc1f2c413e17273c098e8b6ef6d6047d1756a177e413b0d2108be4b10b9f1375d3d2a129521f3c84e86c92b1de8395c6cc9754889fa04c783711ed28ab949f9be64c9ec9bfc4edd34aec3c73e760e9800aa1c698e3e21f542a7802861eb623cbf07f233d83f1feaeca6d3bbfd833bdd717bb45f2c8112cace76d6e4e95cea31a1951915735648fd7038add82436a8f9f6c3c3fb619f62dfe4c6c551153c503ec0e0c348d10060c4496c41b4aeb06283cfcd1ced9f9494f91b872cd9a44cc0b78a548a70e874960c36b2808450a555e5b7dbf7a501681c9817c2ea5da1a93ab315d4ad81248598f739685613bcb0098e9b5b1c364960ddf924fd9315f02d0e3b7c39d150466d3e7c2d604caccbe22ba2c6bd6361d7c99126111785ca0874c8630b565e6279ac9873b070710d2145179420ee6a5b722eb83b8c387bee34f442ed668a4357f386dff7dba57e14ee5e6dac1a284729e92633a3628eea8ef7ca8cf93cd0bf783922e4b7f14555f3964b1d2730c66287a3e16cb3f65bd531050b25493ef0ff839011912aebc256549be341fd1c4667356a235392f79b042ec262b7d94d744f397019c288cde1b7f1c5014733dd7211e33dfae2ca4258940b4c39aca8a542179cf9087349d670530c1bed6e798e686104584416a56799d7d0d6b168b87734a8632aafc30beaa2631c7bd47d55348382ded3844b7e6652c97b74e2127a6b771fd9f39d9b9d7f458a2eaa2becb938e7c670e9b9d8ca5379de203f1f315f7aa01ebe02b0ae57c5845ad56e96334897103fe1ca779f7f8877dfe800ca36676e2cac30c7e6e1199f786a3a303b61df54d365b15be3e8567c9a491562c5724d6e0cfc5b0b5baa044c4b45c9ec68025e6e96e83dc9643005c0af8066ad87726a545ae8f7a9a7b9ab4acf76e3193e578212a449798da4d914abfaa4e10dd5dd0061d6230321b9009831cb5242a4d0fab88359edcd67a21f15204e1a29dd273df63bdfb5fa124de5df611604919e78071e2469a1342e1bd331c0bd653c68f61f100ea77dd45aa13196ee15720c178fab5f8c4b2019f29d7fb7d2b0038848dc134e45f7dc63ef345884dab817683bd765e2477864bf6e9886b714ac2f2e6b6ae3771db368aef58fb60f7ce40e3ec584f4f93b624510161f58c61abfe20c7ea949491d34a15467636ed8d7de9b9ca81a48d1b27a62e591a5e01617229e6a673e76de093633ac1e9a5015b6c94705078e6838fad17ec424ac71cb1bc2154e3ea4db0da4ccf961da51d7e08631bcb1abc52ba348ceb65b1661d335d3b6adbbe75c1bbe1c660c3d006daca4ca1a0f833f7b81f738a9000c29655c63172c5a5a0d21ca278932d216f05c5a005a8631a064ea4e6eccae5769db8f01dc2b364719acc3b1361f23fd4155bf36bf041711f12faae33b5675ece807be343921e234447ecf68f8d3cb74a033c5164da98aa1c899900fe0b057eb0a5ec20e9add7eb353a1d8800b345f055dc7d1d26d2777b83b0bc9d461df7eb7b0f31c252da954b4e4e03e3d6c2dd3c57fbfe92b33788dcc6de0fc0e8ddc901374e8a2d1d52b915a007eba94a448d24456833d336f5b9151388653f7afc5dfb71d65e754b39f94e9761438edd2e9198f7184d2f4474f769783d471fd621dd4aec3d979c150685629cd7be22c89cff4ff7e42077b72be4df0edf7492b709182175810e8b4194f033f6248a1b8eff425040b67d36998be5ce636b20f7038ce71709b8b30621aafeaecef37d754a2c9a5960111852a4c9ba2295047f455d3ea589d8ae62ed3d2b9a9081fc70cbb451189790e91084666047424d9157987ec52c198dc4242da469bb3a48effc7864bb07641fd5844a17fa0d21051cba8f6b474e59323699b13932a8ca411212ad9e3195d53126234a303332b50dc649b9dc9b74dfdc80d3fa0fde38c06153a043a4475a8f3f2b93127bc8d330985e7e4acdc2cad81b2ef19e4580b7acfbca369db05532e7ebc9d1bf6c1a79dc3bf0b092229353e29a590dd991ef73173162d2dcb1a96bf3906274842993ef3f2c1d7c4b3ef0422da9114221d92954cb8681c6e1734b6c53e25f2710e7ad2961836f0a0eab3b172f928a7d99e855ad3ab24eb8d0d24f5b7e34afd5320e85c6c9c98b4637aad617000bc62e4cb0e03495e00bc63b26239e685ade882d3adfcb93c379b48f3e3fe1195a273fd7b6d825ece220aef91012f34e889289c4324ccdd6419793e3652ea17d02d8c5a10cca5f7ebbd158cef05d86226e8e2a05a27ba3c8dd3cc04563058f6356ac0967dd4f5676fdf9bcd9461953bee218d237d4a8895549fb549f4faac50a352c4b7cbf53b4086ab5e77ffd12b220b5984c1871bcfb3b5cb8677dbaa840aef71d8c24990265c72b3ed48754ffd0abde98ebc1111acc39f64122baba7aaaa3411b9092d7e3a8904717c6c790cb148896dde57817933f6754ecc140ddd046de2940d47349e1fbc1c2c7fee73d3cd40e47e0bac10edfbf2578fa6e8ff2af9a47bccc4ceb3894e762a188ae0fd4a9260fe42c3ee57795c04375559e7e453e4414ea686acac22b13c2b84e95438f808f22cfd75ed8639ca789580317b185f829fc063b98ab6f30fb9bcabf0cde10ff88018e1b2a696bc6edf4833b16b50c96e75fd1d17b68303c0b25c44d0775977b9d1f4d663170c72591a40854913b9e7332e082064577a190e3d1444674b85a560fe5dfb9766277cd75b925254553c64b6ce5574e4a864a1a873c4d6e6506ae507e72d41a68bc57ccb7738e75f7b022c9dfac2cb293fba049da2e8d9684c701140ae9ced42d0c5aab1340efc56293895aa42fb6877c2af9cf3f3a328b89719610b832a8fa00418dc2bd37b17259207b901f6e6855b94bb181f6f0874ad61f385ea32baa3050757e27d3147f1ed4ecff17d7cf20264d170fcc6046c43b3612c9b292277312785277eb8c9731c25d407fa6af22ac4d71462e10d65ad711d4e901e1765eacdc6ea73135fac52710f7b6b5270094c7bd67db4aa05cce004a763dd8abff413d5afeb647fbd0cf9e79dd46b47894f7478c3ee849ed1174c4b64ea24d91c1ba730ccb78c36e672469d82ad9e7fcd311bda55b822dd64c318a7df335b04d6eda738153ec01ede264790eb4c80b3eb3d41edd81450bae42b56d4b4e3ec97587c1c5feea68a3299e2429e235d471c71f40161951ed5f0fb37ef6d6445fa63c7a59c8039fede7f40a9bf29908441ad7beb04f341f9a43f38ae97585f9ae204c3bfd075317cb657ebbed32aa05909ae301e4463bc3285926b81a2c46e564b8149f6dac069f65aa4e34b532857c14e21090bb684885c23373ac4e5e30aa9a7d54b5f702660f7f25ee354f5445a0c6999b29332af8c8a63b18979c4dd51fcb60db36e4c005a3df710ae3d1239fc8bb7c1dbfe9aaa824c0e15bbd881d33bd6cc6449a64cfa565a185f0766a78dc68d49b778ec8f60cb83aa9bf0a31e376b63ad96ffd622ce80fc7491bcbcf6ca13300cb98ac3fabefe983290d12a7b280844c44a85e013a504e496a9d534a09ff86edb2fc560ac80b768bf887fbe26b9d9b902a81acfffa8c7cc8bbd5c8d9a33b290aab1321d1a81389ea086e31580a58a0b794984992cbb8f17766fb66195e6d361c77fff968b09b4fb71440ad4883b77207a5a4cdcfb974471dd36d67a7df8ed96fbf5d4356f528309835ea896640bcf712249b4339b668891285f1aa5dc1b850262b9dc21d4cbcb2c1001cdebd992a64d9243cc7d3647b6e46ce0e2c17ba22c21ee337ab570b0e1db3abd251a80d5ab1926d0e4433fc23fa9cab6df3ef4b7a743c13766647b140ec94b25c4b4d7b4cc569b512d63aa464b3e96fa4843141da2d6c62d904c52094c45967a6e9cb1ae2de0babcbd9ea99aaa5317ff9dcb1218fc638c4d8a0a58d793897367c12170157a1d47f73b7ca17938339f95fab65bb9677828cfe926aa4560faa9f070653569771da5819ee9453fcff8bd8ead3aa67bf21abf5486c68704cfdfc26a9b0d364adac0092ffc1be679a03f2e1b265d72bb88be4cec4e5e3e90b61a62c87eb5d7d24ee80ab3ab70c5a9516188d3f857b00480011e9e34b936dd502cc060fda20e3ba667072679aca716387173fbb0910689fbbfebc25210d0e27a3c76d8629585d9f877a3283a4575daa73c802df87832d896f93a3fec9ad7b82e52d0f57bc521ff615f191c86e69aec0bf1182e7ab9f931c135f05de4501336c0bee020740d20660a68d4798bdc4cbc37435634a770d6be39e5a296ab48492be6a868d3d82f9e4defb8d7c5f3d6f4af31abe88ade78af4692b3d4c0d3caed6cfcd2df803908fdb72d150f28a61bf"}) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0x40, 0x2}) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) socket$inet6(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0xf939c21862aafadf) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f0000001240)) [ 1791.631454][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.639488][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1791.654516][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.662685][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1791.712639][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.720902][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1791.732004][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.740109][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1791.759517][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.767543][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1791.778693][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.786715][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1791.824623][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.832650][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1791.848012][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.856023][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1791.868906][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.876918][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1791.888241][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.896313][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1791.907924][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1791.916153][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000008966dc96 [ 1792.010349][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.018517][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1792.030025][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.038040][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 [ 1792.049261][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 03:12:22 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000001d3000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100001e4500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1792.057280][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 [ 1792.087650][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.095695][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1792.118150][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.126242][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1792.137432][T23873] loop5: detected capacity change from 0 to 16 [ 1792.160858][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.162687][T23886] debugfs: File 'dropped' in directory 'loop7' already present! [ 1792.168961][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1792.177284][T23886] debugfs: File 'msg' in directory 'loop7' already present! [ 1792.187966][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.202922][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1792.214955][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.222971][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1792.234374][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.242397][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1792.254672][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.262823][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1792.274622][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.282659][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1792.293952][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.302142][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1792.313567][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.321598][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:12:23 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8d000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:23 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xb000, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:23 executing program 2: r0 = socket$inet6(0xa, 0x800000003, 0xff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2000}, 0x1c) socket$inet6(0xa, 0x5, 0x3f) recvmsg(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000003500)=[{&(0x7f0000000100)=""/170, 0xaa}], 0x1}, 0x0) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) recvmmsg(r1, &(0x7f0000001e80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f0000000040)=""/46, 0x2e}, {&(0x7f00000012c0)=""/138, 0x8a}, {&(0x7f0000001380)=""/235, 0xeb}, {&(0x7f0000001480)=""/110, 0x6e}], 0x5, &(0x7f0000001580)=""/112, 0x70}, 0x8}, {{&(0x7f0000001600)=@xdp, 0x80, &(0x7f00000000c0)=[{&(0x7f0000001680)=""/150, 0x96}], 0x1}, 0x1}, {{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f00000001c0)}, {&(0x7f0000001740)=""/24, 0x18}], 0x2, &(0x7f00000017c0)=""/250, 0xfa}, 0x3}, {{&(0x7f00000018c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000001dc0)=[{&(0x7f0000001940)=""/152, 0x98}, {&(0x7f0000001a00)=""/105, 0x69}, {&(0x7f0000001a80)=""/78, 0x4e}, {&(0x7f0000001b00)=""/5, 0x5}, {&(0x7f0000001b40)=""/149, 0x95}, {&(0x7f0000001c00)=""/232, 0xe8}, {&(0x7f0000001d00)=""/176, 0xb0}], 0x7, &(0x7f0000001e40)=""/34, 0x22}, 0x6}], 0x4, 0x10162, &(0x7f0000001f80)={0x0, 0x3938700}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x40000, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x2, @rand_addr=' \x01\x00'}, 0x1c) [ 1792.415507][T23854] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.423845][T23854] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e 03:12:23 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000001d6000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:23 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff060000000100001f4500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1792.492460][T23907] loop5: detected capacity change from 0 to 16 [ 1792.648953][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1792.657380][T23912] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1792.701540][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.709573][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1792.731395][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.739387][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1792.786531][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.794655][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1792.806605][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.814844][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1792.835418][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.843735][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1792.855201][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.863376][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1792.894462][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.902797][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1792.916972][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.925178][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 03:12:23 executing program 1: syz_io_uring_setup(0x6827, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x0, 0x8000000}, &(0x7f0000003000/0x2000)=nil, &(0x7f0000004000/0x3000)=nil, 0x0, 0x0) select(0x40, &(0x7f0000000200), 0x0, &(0x7f0000000280)={0x8}, 0x0) 03:12:23 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xeffd, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:23 executing program 2: sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140), 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x24, 0x2, 0x3, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFQA_CFG_CMD={0x8, 0x1, {0x0, 0x0, 0x28}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x0) r0 = creat(&(0x7f0000000280)='./file0\x00', 0x0) r1 = open(&(0x7f0000000380)='./file0\x00', 0x10d002, 0x80) ftruncate(r1, 0x400) io_setup(0x0, 0x0) preadv(r0, &(0x7f0000000500)=[{&(0x7f0000000000)=""/46, 0x2e}, {&(0x7f0000000040)=""/212, 0xd4}, {&(0x7f00000001c0)=""/99, 0x63}, {&(0x7f0000000400)=""/197, 0xc5}, {&(0x7f0000000300)=""/87, 0x57}, {&(0x7f0000000600)=""/4096, 0x1000}], 0x6, 0x8001, 0xc3b) perf_event_open(&(0x7f0000000580)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) kexec_load(0x0, 0x1, &(0x7f00000003c0)=[{0x0, 0x0, 0x107a01000, 0x1000000}], 0x0) 03:12:23 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000204500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) 03:12:23 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000ffffffda000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1792.937650][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.945743][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1792.957071][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.965085][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf [ 1792.977102][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1792.985121][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020cca8f9 [ 1793.005944][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.013963][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000323ee53e [ 1793.025482][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.033608][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000012046667 03:12:23 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="390000001300254700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000000010000254500000025000000190004000400ad000200000000000006040000000000000000", 0x39}], 0x1) [ 1793.045052][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.053249][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000004538d29 03:12:23 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000ffffffe2000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1793.102436][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.110557][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1793.124678][T23943] loop5: detected capacity change from 0 to 16 [ 1793.148633][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.156706][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1793.170720][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.178762][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000339c7ad9 [ 1793.190366][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.198530][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000003fba653f [ 1793.210196][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.218311][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000020455f2b [ 1793.229561][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.237607][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000010d09464 [ 1793.249616][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.257774][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000041820dc8 [ 1793.269077][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.277065][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000062787f35 [ 1793.288315][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.296371][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x000000002583cdfe [ 1793.307510][T23912] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.315767][T23912] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2551dbf 03:12:24 executing program 5: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000600)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r3, 0x10099b8) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0xefff, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 03:12:24 executing program 2: r0 = socket(0x10, 0x20000000003, 0x0) write(r0, &(0x7f000018efdc)="2400000052001f0214f9f407000904000a00071008000401fe0500ff0800050000000000", 0x24) recvmmsg(0xffffffffffffffff, &(0x7f0000000000)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = accept$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000080)=0x1c) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r3, 0x8935, &(0x7f0000000000)) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r5, 0x8935, &(0x7f0000000000)) r6 = socket$packet(0x11, 0x2, 0x300) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r7, 0x8935, &(0x7f0000000000)) r8 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r8, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r9 = creat(&(0x7f0000002240)='./file0\x00', 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000002380)={0x0, 0x0, &(0x7f00000020c0)=[{&(0x7f0000000140)={0x14d4, 0x1d, 0x200, 0x70bd28, 0x25dfdbff, "", [@generic="5ab5ff2f124ce928c8fe1e6f706240e3d10d6b01611ce9ba7d1124fa38f1111b88aa5f2d8de3d2cd3dc23bf111d45b7bb2ea7e0aca1a07152b86dfa79f78175e9dfc9b6e64eb1730860346f647ce4170a059df2b4d61271457510a53c0ab92e8ad464fb2949da23e86cf4d0ba6442b32040ca165735badd569d7d9e865bd01e76b8390ab6bcf6065196d22bafc5860b9da8e5f52aca446bffee272bb349468e0f5080c8ab01dc1c7fe444aa8cd24c97e1832d75240b379caea2cee8addd57faa7a48567f118e50381b86addc6e8887d20364071bcfcf06", @nested={0x1092, 0x22, 0x0, 0x1, [@typed={0x9, 0x2c, 0x0, 0x0, @str='::(*\x00'}, @generic="955d85d5d803f5d938b8edf0a55bffb0a8966777e86bf727518915aa50746605929e87e24bffea3cc6055aab65f365216813675663ac98d25c836b87f8", @generic="3481abfda630", @typed={0x8, 0x5d, 0x0, 0x0, @pid=0xffffffffffffffff}, @generic="1947480ec1a76ae03b65ed0abb21746254475d56275b1ebe2ea97cbc0e5e0bfa1d229afe8c55867e8f99c40f742b5540923cc810aa0144cfe02c3b972faff98ffaf54dd4808c18d8004e1876fc609f0e67cf22b093348a7aca7463421c8f67e6c12e217825f270d8e4daa420676ba932d2ad2631a98aa3a19694c84c8e61aea5e55074fe005d0979339e46766a3bf92affcd7c8c622561156fae4086b7136df1e5a44600219d5c6b4588ef006e9155fa8d2c1cbca81e88ba08dfbd15fe57bba1dcc6b6d42486ff79aefd365a70db364c73276124689d2f41b1514320a5f06c7c318fe85a226a1a9ed7d57466f9c6570a4a62884a971feff7d161912c4e826f598ae0775251284b3a7f014ac71aaa2d3b0989b8aa4ea478784b3cc709f4759f86864f804f6843e3c91e5b365f8fdc9ccd360f346e59070871fd9a64de178a56dc1f3adc4028089f416a4f9126af5f36fcd6f03d1b16f12d72b82b9c799d11b8f119bb8fce437ce1d1c97d0901e45a163633ccd565a457f77c7a494e00cd3dd4810cbb13e33390f62731420097adf37b1cc8a04ccc5fba3898d9864aeabd2939dc9cbb0111f4431a6a21f95f5d477f12b23c8d726aca9fb58e4297c8a37a397b81e9170af23c5299d01187f04b663772414eb9343f5bf7896480cacc05610c2b01d3c336e21d5fde1e4c7afb5fac93aa14624d51c6f146504374e3a188d029ca48f38ea01da81df5c7fbc73acae53c7314b5899120e9b99f33a577289b512f547eb06f8e4b49d687c47736788e0f4f210479eb71e862d0994676b62e92e3fb649413e21668ef0405aea13433fc99f38544ecbdc42d31ad887079e680138bec4a4f441efffec280d168d8a636579b12740c387612b729623b0f7a463a1860ef553459ceca61bb2ad686153f59c22b237d67bed4cbbde47860d6536cda2f47a68375121575cd59789238e7f1fc474b5c38a1abbf6c95457fbee5de853c7cecaf66d4e05d06985d3a789969e6b8300e236c4d2f0f48b37cdff32f64d9d37ead14dd5891c2b8349d6570bc02c74036415b372bce504f99077e744ecd8c00b3731a8590b9a84e73634eb196cc64e30f1a25245775104a483b30d7fda6b8dd3922a0dd50da6c5db5a7e8324d30dcd19977877cc8a51194f6e878183915bb561e7e7bcb5394614693537d6f711cea1c27593b06aff79b2dae88dffcd70f3261827e084d1025640f15557ce80872c3ad9abdb92753d8fdc84ea23bf91ca4a0b02bcd3a99fa5cb9c57bfa0c2c596bb1a6caf4fcbd8b448d3c2368c39bd320791d704c82ff9da19b15f3c584b9cb25e593898f7da359664f308bbe86ea4b64836b9a58034d515c3a8db01127508862e88720d603e59aa0b6c3aaf054b7f2e3b7e6866de3a5780842f27c4472072472657181722831a5f9de8f17eed5fd4a434cb2fd607b37d4e6d06143dc21e896482ce9483386ccc11e2c12191319dcf32e94075d4996a70d6e8002869bd400e8859703437195e22b090fabb9ac304cb318fde233a5a388508bdcf4b156c79764b3111b02b229902da1e62838d9a3c0e455bd73ed512384f93d98b9d6cb7ea7f79e4afd46bef21c0299b685f9cef4af8e7f9a5effca1237d7c3674811242aff71531d2ebf7aee3f12e6cda1284c9453a20f99448ac55891d16d5af62c286e713d075375b764d2c7ec5a65c846a14df533b1a5f81f75dacde877664df30c8feec3f19bdb06adcc1086c76ef1b7124c37cace9d00e7102b373f686b177ed5c6dacc313c7a12a9ea4a634dd400d7f4a4495b914c94b827f59e43ba6eabe88f810ee53b3f93fd5a981ce2935266a7c39a07c71b84a8d6f7995aad1f24c470548bb346dae6c51681b5e3d71cb7337f668e0465c25815b1584eed73eec243481e1ded4f7a5834238edcce57a0da75fb2fcb1564f0b4c48f1c37ba49d6ef5a8c868b398c4839cd8d12767afa0a87e0f506a37c4daf7c841fe79c42f76ef76c2ce10142df6a5133d68647dadce9575e308a3c63152ca93bad3b4542d3742d61f4a5bb066f8d2bc19dc5cb08896d9b097f0b2445817069d6f4bfb1e2ec506a7b1dc2895667f65e40b5d89d2ea6e540b4f02e05ac9363a1c6a84046c76c3f8de9ecc43fa6a27b7567f4e4cdb67bcca48f80417199fa454fadc794a888ecfe63c8c55cae6f6e4025d62436cb4e0592eaf9696f7acc7268a6d9ec00a8e9791d210278ce132269afa3a57fd9dd33fb63e2cfb4c40b7e96fec16c32f9262dec1a0f3378f26db377ca33da87d989f3e7517dd9321e1c67309c2c56959fc6b1b428021e521d18615e90d9fcf815e9f9d875e9096da5637f672150971623ba83e97a0c0d7bca078b01e5b3bff5b4c9c74c061ab0195d2eb45add4c84d9790f9865b8dd09b4f721a0172648abedd7cb73e3ba9d653b98669f5b2d001813c149c545212671d4fdb31be4cb6db095e6dcb37ba3d6634a127118d501555d0ac80f75f10d2d52d91b2e76ffb1916040978059ae39e0b6368017e2b53cbfff2c4d759e24d6c3d1b8eeb3afa14ebb0611995c94e252c7a9691351e1201439444cfe03b3c66be0dd05f85e3dbd0e43ad87b9112eb1e70fd815c506ddf106af8ab5ab101c9c677b60a57b9fd7b0d278d3161d438a7bc11ae7271d3bc845c35feb017d78cdad55fc6669b42c01a3702f2ab12dbba844078ea9e1ed24e07de339aff491709618fd3a595df958aa594ee66618cb07929fa0ae8c730ace6c4e5afa641843a23db60e4a63ce364b7e2eb3127013b5476738402ed939800d8590cbebd7c82591154ad21429ecc6d1f2e895fb8e2b893b43cfcc011b78777a01cb60508c983128d321720f03454b55518226352be452a2ec5e496c5ddc157e43a3a8ec3e9b86d954cddb9bd55cf1868770e1fe5dc4f855ff0bc0df42dddc34341f0a25afc6c27b49e54ccde56cf369b9d77f54ef1de92daa980620d10c0ba4f1a05fd5eceecd817d6d3fd1fb9c556ba959666ea46f82628be940f7fba217159a1d007f3f68bea62f89de89e043d58caa096a9a8321cdcc7e60974f65d5e3819f6a4a4a1c2b591734c665090778f50f8e8f2088b888d1c56cfafaccef1e6878eea81bbb195f3ff9f4acafd4267fe1be45378134823ea136898f33e77d81eb9e7c1a5b0aa70fd967fc8f3b5f80f651e26c166ac7e3edb11e6a8a33dc82ce4f453914382c11b1e60c25bedcda7de57f037be67e20454161f974da3c23286174ffb02fcfab0ea4f4ea08a53c522155fdb6956aeb54da1667fabc0e6b41d66dc290e2b570fa111e0ebd9a203131b34090f818008cbbba96a275f7ecbcb017f7de0b3fbb2ddd5fb72c5e1fb8c558faec3a82a4a232bf16836e262fb74ef6077cb43721e519659af1e5218761ac12afea55c6b6e9d90690d9c55388815088f3f395b7adbe42afe682258092ea4075555e33203fadaef8d1d63c87c91cd53e1fcc7fd301953fab3e6498ed62d3755b726abd4028c121eed137a3ca74b5c797fc43bba90309966d36ffb66fe4de8b995131aded42ec4a85bbd5cb82ab031ee5406d1b3160505019bc755d483767c58c397b27f99f87fa9e45ddb878acc66c694e88b4ec51d5e0e33889e39faf83249ff25facf22e644140bec4ec5b2348d3158ba16383476156c31dffa77c448f23942e9c3fb57877b0fe269b5a518d67224daa2bba91c479501953ebbe769769fbbff5634d308e65f058c1b15a19bd68242334106a7e264d8f715b9c5cc2f40b522452f9033ba802e3772a9347e42c4740efef8c1e89e5c10e88cd52540e39d54f35f4e75d4f8f2d1332ccd0afd018980a1181600325c09e829ae69e57baf509eed1da7437282c6803e41ac1c624d7a2cb71fd8980575e284161578fddd353523fa7dad2d065b36ea31a8e03cb35cf7c2ef16f34b34d578d3766b114ed0048110d255d367da9c181d909a28d3aca423134b5aaa2f416a2ba4214fe84d6ad255c9a93e82f46fa23d30a6221dac06c2ee26ba220ddfe280c8a6ee94f972be8ea5ea7540cdd83cf9ab12839b0cf1e1107776ba6637de278c9b1a3c2b00ca87f106942a032292f36774299955ab5e43351d38d24206963fd5f5e11fefdb59b62bef9bb457832c600e911a26987c39719d15f4d2891148ae5f118fdf5953850e2045e79f4307f853789727cc81f6fc84bfaf585672dd2f29c0abc0a72e9f92fce88def005febbe2a7c8f25e981d55c5877144fff64d8fac590d46ce9ed5ffe24d8683b57a5b53503741372fd13a1ce36655a3db329b70897e24f51d8a9db4845d1f0ff18350a254f2fa0585083ced9cb71c1e502cf2dc097f3f012c176d3b7b9c9eb88da61f68e31cd8c4a9134ca14f4b62ecf396d7a3d94903ba404162d84aa44bba7cbcd3ceca401556102abf1a1ad7eb0944e8c1270fe41feacbe5ae0d175579cc04a4228b7781ffc44fe8a0698554457dd29028e615810c5726d21e3e5493b675727f83cd5b9162a19ecfc3e911bfab920f46e7dbb60e613fd5bf692e3fdca8f5f47bc5d1c9035da1172391ef8ade4927ab2320eb1049b0d98cd0b4dde660b5f6b47bca7a028102fa15cc244412ed37ac012515683a08f55863ba357a17b993c46851f051cb545bf1bdf8311de30e94c673a4067adc36f84fc0fc248f2b1c3ba4d9cf1af9bf18ab3827ea5b4d849cf62a2173e353c815917d9f6ba794a792c00bf02ba1290536e742e547d8335f523f69298b30a0c04145192501a32974a29ea294ce68a8098cb7a7d5cf442d0d192079acebf0871b22cd4cbdc13eac1a62e9f82fa11e3fd1d165f8f36d72e9d85a87ad81af4716a11a3c41d84d6d7616abb1e010bbbf6ee0395416ba47addfaa83762118935c81f5671bd08bed67eed2fc1e53e61b246bab50bf8a79858f87404654149b57f9a74993b40064c830396f9a488bc7dd4d4f21888c4a6fe68598113734421ad5e42d7862df13f91382c0a6d1e6f2f27a58db69231a97c1eb7dcd93e819e0edfa667a36bc6d58e7533082ffe86c0ebba3238bb166a87518df6cedda2511c10b06a20d96c9d4b6aa11e38a1c0d7be72f1f2fc6fb9008ef16bdc06c1b19d6c0023dba4d82127cb5e0bb46ba81e5d6f4e384de80d7017975eb601e868fc94679d52f3ef2262d82d5327284c88b2c2912fcfd8d457916275255f9afdb6437813925217e28be10d2921060a8ed8676121453a1182a327adee65524efbdc27997a477e85e99b7e4f395571d1ff783f63ef2ddeb6127c20bbe2cfa4a0881c5bd05623ca843334fcb3a8a6f2793a6ddb91358b9bde37029495704e90431b58eb5171b1cefc462d12de0b21d8e25d92cc8ada7c19ea240bfda037ee3bdfc947f5264f639d9560ee9cb62f0572b1abda93cde0d5bb2cb307d935e857c7843ba60490f1831db8e33d562403445ccbd524e901bc63cd681a58e98c4ea83cf55f67753b97c0c448869cff1e86ca94c38d826aede3f11f28f85a2de043aad12d82ac916ac4999eaffbab6d051397110ef49a3cb6e1f49ef28fe0ad266aabf8dbf096581574b85e050565a0a94c7befc8e566d24437164c64b835ea652b7d9e894083fc6df3b9f8442d86c789304e7f84e645f601c2b72e09067266f8cc9649c4a2d11a46feaddce737c498f577bed39f723e4aeb635045be81404b4c42ef7e2116b016467950800d3858b658a3052577b48603f9628d6dc5da59c26449afacb6dcf5da2e9c53a1e1f98a8dbab8e6c4aabcf909da64a125e44025ea956db75e6b35a04fd507965555a15c33294c24eacb2b355a8d5d6", @generic="b0bb61adaf1bca65ce8a82d2369b2104f9076eacbefd068ffcc75e46acf76420f28cea88aa572719cbc140", @typed={0xc, 0x68, 0x0, 0x0, @u64=0x8}]}, @typed={0x8, 0x46, 0x0, 0x0, @u32=0x9}, @nested={0x11f, 0x0, 0x0, 0x1, [@typed={0x8, 0x7b, 0x0, 0x0, @uid=0xee00}, @typed={0x14, 0x3d, 0x0, 0x0, @ipv6=@mcast2}, @generic="ed16bbc2c07e0419d9e5ed7e64067fde2da5daf15b", @typed={0x8, 0x66, 0x0, 0x0, @u32=0x20}, @generic="ad759c145b5b65e8db568283a724d747d48fa0cf98e11379bb37202a06ff694ce05541143dc2f8e40d103475148990bb9cb719c2f1c69b95c7b19b46e1a36607a6d974cc718c96ffe2f3559194cd9934c503088d90141856093748c6835e1b367ec67f6240686dc4f1c5bae1fddd9b14ca3e40a49296372994d43d61c3d40bec8f7bfa9a0e4f2b5580854d730abdefdadfd671e4c3089f4eea7e05a8eb599f95b365d199f521224e56447cf04b1361948b36d6314c5a8a7bc950a6908b578dc90ce01198902fd05d75caf31e753ecfd0a4f7bc5790584e82f6383ea3b6ac9b150946"]}, @generic="54acbf39bbe92b1e5e8f544f23a99cc523e084afdd88fb52034cfbf1cb58b1853c4c38c16ef72738a1a903f3827f9fd64ca2a106e14d778f20bd23a80f5ec04f193f79f8967e926e33d9a4a5749ede2457eea09c9b83165920380247d39536", @typed={0xf9, 0x1, 0x0, 0x0, @binary="e0d098b02043cb033ddc6a964891c72ba815748ef57bad5e0a0bce51e9e94c89d642c8c280ff959ace23607e2322360e95ac10023580fc63b2f4d5099f7f9a58da27c92aacf57667deca4fd1b314cb4fc689cce9c05919b33fd81b6b1dee62e3601784ee9ef7f944d5702cacadc011af569ca5bbce2dc016ea54a098f9034cc7126f0e60ef767c54daebe6ab60c67a28cb118819d0e71abc6ea603e5c6e488a3e7db245ea24f024d1123705a1a2f95373d8c1fbed83616ea0fdd4277bc110c0ea564d708acc137f0f1f285a8d1f1d1bd2012ad63c564e5856bb6709dbca8ab0241603896251a8310974493d27c6c11d2395882d31a"}, @nested={0x10, 0x8e, 0x0, 0x1, [@typed={0xc, 0x40, 0x0, 0x0, @u64=0xfffffffffffffff8}]}, @generic="838f6e906656cc78ad55a26f36e57f3512cdbb35c9a2cbeb808bbb640ca6cf4338ea0edfbeee28589dd69dca48aefef8d57970a62673cda69856c1acd76abd705e1d6ae7d9cf585319e101176250fc065c7987546d2863c257ed5b62e9bfffb76d0a48c18b50f0fb2e3cf3f7c295544c1874a4e593c7c2ad7d5d8c44f601a24df5a49a3aa6509ab0d491b81ed298c216915d855c98ed7480d04580f0a646c9016e84bcafbbcb0e6ed8794853006691a0689a05861dec203ef507d80a3702e40f68", @typed={0x4, 0x5a}]}, 0x14d4}, {&(0x7f0000001640)={0x340, 0x1d, 0x1, 0x70bd2b, 0x25dfdbfe, "", [@generic="9edf2d97cb2091fa6a32529388eea7a11707d13af5515b8477ab93eb54c1c38da2d006fdb0237a74870c16f289765f78cc91602969a34670601e69dfbbfb466cdfbc0068fff7f16f2c330c243eddd216884774529b06446556b8998cb015462806a7af321381e5cde10f5caf766c5bca574563d3de436b2c84d8ecf1fdb7e25f35912c7fcf20fc00fd63bcf05b74892956b7f43e3e6def8bd82a5202acd4ccf21fa9b8668a6cd9669a94ead1d21271de82af4be740f804f8", @typed={0x14, 0x35, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @typed={0xc, 0x3e, 0x0, 0x0, @u64=0x1}, @generic="6286caab8e46305bf13aa57185680316f38a837ae12d49e9f9a3f7156409e83c107871bf77342b5e79b1fff283b20aad279a0220baf24b48fd71fba3fbc9447a97395ec4bc9e9e2384d4fd0895cb113a7faf921d", @nested={0x203, 0x7c, 0x0, 0x1, [@typed={0xcd, 0x95, 0x0, 0x0, @binary="b774371589e0f99223847e9394f5a26e98127b2d76a92febb7403cf997ccfb1a494470ea6df77999d79b2e049e5a6d5fa3c65e1bb20b1388e299d6296c6a442a0f8a909236e3bff3479bab4d22cf18cd580904b80fa4ba5ce5cad2263934322300f6ddd01d4e0d96f01d9f699ebe37d3a7dc47311910deda8b2b2973560160e26e550331426411ae944a91c165c8df5524799099aee8199db86b605a799c82c2c5e7ca675ee17706c090a763ec5c4bf6e035e20f27c6af7b70db202b8d68894af1c28b8e6c718d070f"}, @generic="e351642f2aa34d7e50173b3396cad2f1ba6e49e2c812232c77f5b45a34ea617c5b7dccbb4ff58f03fffd63ce089d3abe9eeb92c4906f04b2721cec57157972c4789abd72e8380354819f3976070af36d6efff83be5d0bc1a8f09211ff8f4de38dad64aad70e15f67a5cce4bf6ce27070f6a61719fa22f77169407c25873eb3924bd1bebca4141bb0a103a44a21ba7e9a7013bbdde2fc7bd13f34d1bccfdd1c9468b52c75acf01a4f0bf9ac0dfade28e88d8b9c1b859e089cb604dd2dd54722f47f8c26bc8d9d1ccaab437e1b64d4", @generic="057060d192b3e1880cf5e595d52f9230dd0ab4287ac694a1ad689a114da78e84587e86303f83f44f5fed307f3e7a3243127bb456ef46751f7afe688a345afcc3175326a4c470bf68c0cb6d06171e131dd51bdcb5d03f6974cb583a24df78a8adb6"]}]}, 0x340}, {&(0x7f00000019c0)={0x24, 0x27, 0x100, 0x70bd2b, 0x25dfdbfc, "", [@generic="6f71dabcb55f2fc6d47928c4e5b9b6fc693788"]}, 0x24}, {&(0x7f0000001a80)={0x230, 0x12, 0x400, 0x70bd2d, 0x25dfdbfd, "", [@generic="d4be157d49c008d445840eaed3268138df175cec32828ee8538b2c66887f71ca539cd836deac2617e3a469b327a628b1ab544c87", @generic="b7ce91b2907e50db079a408c4d04091cb8f2705d0f1247eecc3d33eda3fe6b092970754c10c753de1b1fca08539226bbdad277885d85be4cd139cf857b35619fb09f411e5d807a886187819e5da09915acf7ba01f509690cbfce5314af203ca8ecd48ddd0d77d42125e7a299e0d8049f823b9648452a0573bb27802b6f88e2997e2e2770f668e2371c7bba0cc958ca1473a32d33db1d363598fbfda4d5f755073d13bf580dcd9a635d9e4b1a7f540299c47b5ab5447b1364d545df390cfaa3b9aa143a7c7627dcae55318c470840c544d2a4c7da9084b82c17ae46838d170732f00c48d98f4d0d9d8942", @nested={0xc, 0x82, 0x0, 0x1, [@typed={0x8, 0x4c, 0x0, 0x0, @u32=0xffff8001}]}, @typed={0x8, 0x54, 0x0, 0x0, @uid}, @generic="0e20ff12b7911086bccd5db6b948eb26eb478b45990faef83b5f7108bf9c68cbecc7935731cb47b061b71207d17c254fa8ddd4615da75ea9aa761de9c755a34a1485ac3888857094a4f975b5919d797f886f661a6dbab7fb1634c9bee3b9c8fc022be9f3929f8409cf0fafc70769c9beb11cbf555613b65af6ec50dcd47f6a62eaa253561c9fc0cc55f967ec4a7bab01837fc1cd98086975bc5f37556fdf4e95bbc42910d44d89b5bd87e6c369aa1a6a8f32838d18ca01d7b0f4509024fb007878d57540b01df5eca0ec73652a", @typed={0xc, 0x49, 0x0, 0x0, @u64=0x2}, @typed={0x8, 0x7a, 0x0, 0x0, @u32=0x7270}, @typed={0x9, 0x7, 0x0, 0x0, @str='^0@[\x00'}]}, 0x230}, {&(0x7f0000001cc0)={0x180, 0x41, 0x300, 0x70bd29, 0x25dfdbff, "", [@nested={0x170, 0x23, 0x0, 0x1, [@generic="ee3a7fe3779cfce94367f1884ab702385c253d65429e35f77a2706804713a82498f42754c2a38148f7e1beba0eefcb9836b9f888d981046ac6f079bd8b40845fb0a84063d8548f4a441067b8090bdc0f9c39deb79b38f8538de9f280772463dfabbc62db6d13e10519a495374f39df90f795efbeef0b0e9d373cf5f21ae5dd01ee2e8390750ae02c10c95ce8d942db859a66c43546bbe4794d1ba4989e2dac53", @typed={0xcc, 0x5, 0x0, 0x0, @binary="6c688a6323d6cbd323728062cc860d4019ac0f50b1ca11172be64afc5e7da9506b125c3f8ce795619e22d1456506b1bc08437df8e888b0861eeade90a3e9e223ca18a454206b0a01c31e3144adad93299eb85cab1c0fc17aa92023951f84806578c5cfc3194421fba0137794614017e6d4d66210ba1e0a569b9fab90710d163dedc84d5534a7364f8537db7f71deffb129aae0fa3657ded0c9a68115e07573868de189780718b7e27387143a0ba152168d8d07b1e9b171fae13d6145ae163d553e95cb8baa101734"}]}]}, 0x180}, {&(0x7f0000001e40)={0x260, 0x32, 0x200, 0x70bd2b, 0x25dfdbfe, "", [@nested={0x242, 0x5c, 0x0, 0x1, [@generic="903ca83455219a0efa88d0ffaa0f4c36166debf8622e43186a0de2e5a464dc8ce73dc104dc7d1f6842cb15dadae665b59c0784454013fa867dec711074ae2b9ffa8239b596d6b808bbf5cd5ec861a314d77e7d174e0c9a6ee36d52592a1fe2d9d039fdeb2d7bbd93b4e14121d6d27fc6469444cb36e8ad7dd53f31", @typed={0x8, 0x25, 0x0, 0x0, @uid}, @generic="075c8ca53dd4f90e281228cdcb3ff75fbe2771be4453c421334b066295342cf052881e93a25c0deebe19f65236c5eb2311234f09439fd7440aea45d6ae5f24dc973d283e44d586a873af42043e880477f15a0438796550fe8271de00a3ec2a28bf7007c9d4d881fd747dc16f35e5a65c298f5d9f5bd13c31829afad5baa715b38990361d48a212335e687cbc0cebb949f772059cf7669351499ed97b9322cc98f6daf940d16f3a4d1fcd04095d77dabf7c34950e9dfbd3c859710b7738e372", @generic="86d13b6e56366849c10a3eaabb0668f361dfbb7424d206441e2d4d91623c9dbf0a2c4727cde466ac533802b9c9c2a511ed1ba1fb09bc6227c6ffd2116c9f967cb6160ccb3cfdcce1ed0f2fc8647663f13eaf6f55794d2e931c2991ea713b0d6bbb9a5cfdb06f3e420d810bb558c210d609840b682cd107033af1f34a3d7f85513b35de1a01e8fe28f49c724d0bb54da453662b0c23dcdd1be6928a766383e8d059b56123464a34d94faec94a6d3f0835e48d56b662f9058c34a4e3bcf9e167cbe1742ce8d9ee1a340bf4b7f8095b629fcd8b5bdd6d9dde6f7fb0fde05bcb564e2db0df061d6bf98f483ecb39ddd2d8ce3614358f5e575ee6c285d765"]}, @typed={0x4, 0x20}, @typed={0x8, 0x2f, 0x0, 0x0, @u32=0x3}]}, 0x260}], 0x6, &(0x7f0000002280)=[@cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, r6, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, r0, r4, r5, r6, r7]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xffffffffffffffff, 0xffffffffffffffff}}}, @rights={{0x34, 0x1, 0x1, [r3, r3, r8, r3, r0, r9, r0, r2, r0]}}], 0xe8, 0x20000041}, 0x24008000) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000000c0)={0x8, 0x0, 0x3, 0x0, 0x0, [{{r1}, 0x3}, {{r2}, 0x100000000}, {{r3}, 0x5}]}) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x810, r0, 0x825fd000) 03:12:24 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000b, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e000000}, 0x0, 0x0, 0xffffffffffffffff, 0x4) 03:12:24 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000001e6000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) 03:12:24 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f00000001c0)=[{&(0x7f0000000080)="20000000000100000c000000ce0000000f0000000100000000000001e9000000002000000020000020000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x400}, {&(0x7f0000010400)="2e0000001300000023", 0x9, 0x800}, {&(0x7f0000012b00)="ed41000000040000d7f4655fd7f4655fd7f4655f000000000000040002", 0x1d, 0x8c80}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6772706a71756f74613d6a9817c77f0705d9733494342c6a71666d743d7666737631"]) [ 1793.515599][T23969] loop5: detected capacity change from 0 to 16 [ 1793.559409][T23974] ref_ctr going negative. vaddr: 0x2000000e, curr val: -9199, delta: 1 [ 1793.567763][T23974] ref_ctr increment failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x0000000087b0b24d [ 1793.600390][T23974] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.608444][T23974] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000259d58c0 [ 1793.623191][T23974] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.631248][T23974] ref_ctr decrement failed for inode: 0x361e offset: 0x0 ref_ctr_offset: 0xe of mm: 0x00000000b2633c92 [ 1793.682453][T23974] ref_ctr going negative. vaddr: 0x2000000e, curr val: 0, delta: -1 [ 1793.690457][T23974] ref_ctr decrement failed for