ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:53 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x7a000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:53 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0) (fail_nth: 1)

[ 2352.048434][T11716] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2352.063652][T11715] loop0: detected capacity change from 0 to 4096
[ 2352.080697][T11717] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2352.096581][T11715] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2352.101320][T11718] loop5: detected capacity change from 0 to 16
[ 2352.114742][T11722] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2352.130529][T11718] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2352.130529][T11718] 
[ 2352.154421][T11886] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2352.166619][T11718] FAULT_INJECTION: forcing a failure.
[ 2352.166619][T11718] name failslab, interval 1, probability 0, space 0, times 0
[ 2352.179335][T11718] CPU: 1 PID: 11718 Comm: syz-executor.5 Not tainted 5.15.0-rc6-syzkaller #0
[ 2352.188121][T11718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 2352.198178][T11718] Call Trace:
01:50:54 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100feffffffdaf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:50:54 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:54 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x4c000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:54 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x8a030000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2352.201457][T11718]  dump_stack_lvl+0xd6/0x122
[ 2352.206053][T11718]  dump_stack+0x11/0x1b
[ 2352.210205][T11718]  should_fail+0x23c/0x250
[ 2352.214643][T11718]  __should_failslab+0x81/0x90
[ 2352.219407][T11718]  ? kobject_uevent_env+0x1a7/0xc40
[ 2352.224618][T11718]  should_failslab+0x5/0x20
[ 2352.229196][T11718]  kmem_cache_alloc_trace+0x52/0x320
[ 2352.234484][T11718]  ? kernfs_put+0x22a/0x300
[ 2352.239123][T11718]  ? dev_uevent_filter+0x70/0x70
[ 2352.244135][T11718]  kobject_uevent_env+0x1a7/0xc40
[ 2352.249197][T11718]  ? kernfs_put+0x2e2/0x300
[ 2352.253698][T11718]  kobject_uevent+0x18/0x20
[ 2352.258257][T11718]  __loop_clr_fd+0x601/0x850
[ 2352.262858][T11718]  lo_ioctl+0xac5/0x13e0
[ 2352.267123][T11718]  ? cgroup_rstat_updated+0x34/0x100
[ 2352.272485][T11718]  ? drain_obj_stock+0x350/0x3f0
[ 2352.277557][T11718]  ? mod_objcg_state+0x53f/0x650
[ 2352.282483][T11718]  ? mod_objcg_state+0x3ff/0x650
[ 2352.287426][T11718]  ? avc_has_extended_perms+0x67d/0x8a0
[ 2352.293017][T11718]  ? blkdev_common_ioctl+0x438/0x1110
[ 2352.298426][T11718]  ? selinux_file_ioctl+0x981/0xa10
[ 2352.303624][T11718]  ? lo_release+0x120/0x120
[ 2352.308133][T11718]  blkdev_ioctl+0x1d0/0x3f0
[ 2352.312705][T11718]  block_ioctl+0x6e/0x80
[ 2352.316976][T11718]  ? blkdev_iopoll+0x80/0x80
[ 2352.321605][T11718]  __se_sys_ioctl+0xcb/0x140
[ 2352.326226][T11718]  __x64_sys_ioctl+0x3f/0x50
[ 2352.330809][T11718]  do_syscall_64+0x44/0xa0
[ 2352.335266][T11718]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 2352.341228][T11718] RIP: 0033:0x7fa77033c7f7
[ 2352.345717][T11718] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 04 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2352.365335][T11718] RSP: 002b:00007fa76e0b2fa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 2352.373797][T11718] RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007fa77033c7f7
[ 2352.381769][T11718] RDX: 0000000000000000 RSI: 0000000000004c01 RDI: 0000000000000005
[ 2352.389736][T11718] RBP: 00007fa76e0b36bc R08: 00007fa76e0b3040 R09: 0000000020000000
[ 2352.397698][T11718] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
01:50:54 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[]) (fail_nth: 98)

01:50:54 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2352.405666][T11718] R13: 0000000000000016 R14: 00007fa76e0b3000 R15: 00000000200000c0
[ 2352.660308][T12032] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2352.673171][T12033] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2352.693913][T12086] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:50:54 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x60000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:54 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x8c020000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:54 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2352.722776][T12239] loop5: detected capacity change from 0 to 16
[ 2352.736577][T12241] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2352.750553][T12240] loop0: detected capacity change from 0 to 4096
[ 2352.771993][T12239] FAULT_INJECTION: forcing a failure.
[ 2352.771993][T12239] name failslab, interval 1, probability 0, space 0, times 0
[ 2352.784712][T12239] CPU: 0 PID: 12239 Comm: syz-executor.5 Not tainted 5.15.0-rc6-syzkaller #0
[ 2352.793505][T12239] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 2352.803560][T12239] Call Trace:
[ 2352.806847][T12239]  dump_stack_lvl+0xd6/0x122
[ 2352.811463][T12239]  dump_stack+0x11/0x1b
[ 2352.815698][T12239]  should_fail+0x23c/0x250
[ 2352.820106][T12239]  ? mempool_alloc_slab+0x16/0x20
[ 2352.825127][T12239]  __should_failslab+0x81/0x90
[ 2352.829950][T12239]  should_failslab+0x5/0x20
[ 2352.834507][T12239]  kmem_cache_alloc+0x4f/0x300
[ 2352.839262][T12239]  mempool_alloc_slab+0x16/0x20
[ 2352.844116][T12239]  ? mempool_free+0x130/0x130
[ 2352.848786][T12239]  mempool_alloc+0x9d/0x310
[ 2352.853285][T12239]  ? pagecache_get_page+0x7aa/0x910
[ 2352.858491][T12239]  bio_alloc_bioset+0xcc/0x530
[ 2352.863248][T12239]  ? __find_get_block+0x85c/0x930
[ 2352.868278][T12239]  submit_bh_wbc+0x130/0x330
[ 2352.872923][T12239]  ? __getblk_gfp+0x4d3/0x590
[ 2352.877602][T12239]  submit_bh+0x21/0x30
[ 2352.881820][T12239]  ? __wait_on_buffer+0x60/0x60
[ 2352.886702][T12239]  ext4_read_bh+0xf1/0x170
[ 2352.891139][T12239]  ext4_sb_bread_unmovable+0xf7/0x1a0
[ 2352.896530][T12239]  ext4_fill_super+0x22c4/0x7830
[ 2352.901487][T12239]  ? vsnprintf+0xe8f/0xed0
[ 2352.905937][T12239]  ? snprintf+0x83/0xb0
[ 2352.910099][T12239]  ? set_blocksize+0x197/0x270
[ 2352.914870][T12239]  mount_bdev+0x1e8/0x290
[ 2352.919225][T12239]  ? ext4_mount+0x40/0x40
[ 2352.923713][T12239]  ? ext4_errno_to_code+0x110/0x110
[ 2352.928920][T12239]  ext4_mount+0x2d/0x40
[ 2352.933120][T12239]  legacy_get_tree+0x70/0xc0
[ 2352.937735][T12239]  vfs_get_tree+0x4a/0x1a0
[ 2352.942151][T12239]  path_mount+0x11ec/0x1d20
[ 2352.946660][T12239]  __se_sys_mount+0x24b/0x2f0
[ 2352.951342][T12239]  __x64_sys_mount+0x63/0x70
[ 2352.955934][T12239]  do_syscall_64+0x44/0xa0
[ 2352.960417][T12239]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 2352.966361][T12239] RIP: 0033:0x7fa77033df6a
[ 2352.970770][T12239] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2352.990374][T12239] RSP: 002b:00007fa76e0b2fa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
[ 2352.998827][T12239] RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007fa77033df6a
[ 2353.006802][T12239] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fa76e0b3000
[ 2353.014849][T12239] RBP: 00007fa76e0b3040 R08: 00007fa76e0b3040 R09: 0000000020000000
01:50:54 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2353.023093][T12239] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000000
[ 2353.031072][T12239] R13: 0000000020000100 R14: 00007fa76e0b3000 R15: 00000000200000c0
[ 2353.042973][T12239] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2353.042973][T12239] 
[ 2353.054761][T12240] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:50:54 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[]) (fail_nth: 99)

[ 2353.087599][T12346] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2353.121415][T12393] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:50:54 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x2, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:50:54 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001020000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:50:54 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x8cffffff}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:55 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2353.149920][T12347] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2353.180812][T12530] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:50:55 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x68000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2353.237869][T12657] loop5: detected capacity change from 0 to 16
[ 2353.257757][T12657] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2353.257757][T12657] 
[ 2353.285074][T12687] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2353.301168][T12657] FAULT_INJECTION: forcing a failure.
[ 2353.301168][T12657] name failslab, interval 1, probability 0, space 0, times 0
[ 2353.313823][T12657] CPU: 1 PID: 12657 Comm: syz-executor.5 Not tainted 5.15.0-rc6-syzkaller #0
[ 2353.322588][T12657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 2353.332668][T12657] Call Trace:
[ 2353.335945][T12657]  dump_stack_lvl+0xd6/0x122
[ 2353.340536][T12657]  dump_stack+0x11/0x1b
[ 2353.344700][T12657]  should_fail+0x23c/0x250
[ 2353.349161][T12657]  ? kzalloc+0x1d/0x30
[ 2353.353229][T12657]  __should_failslab+0x81/0x90
[ 2353.357987][T12657]  should_failslab+0x5/0x20
[ 2353.362530][T12657]  __kmalloc+0x6f/0x350
[ 2353.366677][T12657]  kzalloc+0x1d/0x30
[ 2353.370667][T12657]  kobject_get_path+0x7c/0x110
[ 2353.375450][T12657]  kobject_uevent_env+0x1be/0xc40
[ 2353.380493][T12657]  ? kernfs_put+0x2e2/0x300
[ 2353.385009][T12657]  kobject_uevent+0x18/0x20
[ 2353.389510][T12657]  __loop_clr_fd+0x601/0x850
[ 2353.394130][T12657]  lo_ioctl+0xac5/0x13e0
[ 2353.398438][T12657]  ? rcu_segcblist_enqueue+0x8e/0xa0
[ 2353.403761][T12657]  ? call_rcu+0x261/0x6d0
[ 2353.408095][T12657]  ? mod_objcg_state+0x3ff/0x650
[ 2353.413100][T12657]  ? mod_objcg_state+0x3ff/0x650
[ 2353.418091][T12657]  ? avc_has_extended_perms+0x67d/0x8a0
[ 2353.423634][T12657]  ? blkdev_common_ioctl+0x438/0x1110
[ 2353.429098][T12657]  ? selinux_file_ioctl+0x981/0xa10
[ 2353.434311][T12657]  ? lo_release+0x120/0x120
[ 2353.438882][T12657]  blkdev_ioctl+0x1d0/0x3f0
[ 2353.443378][T12657]  block_ioctl+0x6e/0x80
[ 2353.447688][T12657]  ? blkdev_iopoll+0x80/0x80
[ 2353.452345][T12657]  __se_sys_ioctl+0xcb/0x140
[ 2353.456936][T12657]  __x64_sys_ioctl+0x3f/0x50
[ 2353.461601][T12657]  do_syscall_64+0x44/0xa0
[ 2353.466027][T12657]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 2353.471991][T12657] RIP: 0033:0x7fa77033c7f7
[ 2353.476482][T12657] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 04 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2353.496282][T12657] RSP: 002b:00007fa76e0b2fa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 2353.504705][T12657] RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007fa77033c7f7
[ 2353.512667][T12657] RDX: 0000000000000000 RSI: 0000000000004c01 RDI: 0000000000000005
[ 2353.520638][T12657] RBP: 00007fa76e0b36bc R08: 00007fa76e0b3040 R09: 0000000020000000
[ 2353.528600][T12657] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
01:50:55 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xf6ffffff}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2353.536620][T12657] R13: 0000000000000016 R14: 00007fa76e0b3000 R15: 00000000200000c0
01:50:55 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x3, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:50:55 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[]) (fail_nth: 100)

01:50:55 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2353.578846][T12866] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2353.592288][T12868] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2353.633596][T12870] loop0: detected capacity change from 0 to 4096
[ 2353.641444][T12871] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:55 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x6c000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2353.676114][T12870] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2353.712809][T12974] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:55 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001030000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:50:55 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xfeffffff}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:55 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2353.774399][T13228] loop5: detected capacity change from 0 to 16
[ 2353.786461][T13244] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2353.802130][T13258] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2353.814844][T13228] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2353.814844][T13228] 
01:50:55 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x4, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2353.881379][T13228] FAULT_INJECTION: forcing a failure.
[ 2353.881379][T13228] name failslab, interval 1, probability 0, space 0, times 0
[ 2353.884011][T13283] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2353.894062][T13228] CPU: 1 PID: 13228 Comm: syz-executor.5 Not tainted 5.15.0-rc6-syzkaller #0
[ 2353.914171][T13228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 2353.924260][T13228] Call Trace:
[ 2353.927535][T13228]  dump_stack_lvl+0xd6/0x122
[ 2353.932126][T13228]  dump_stack+0x11/0x1b
[ 2353.936356][T13228]  should_fail+0x23c/0x250
[ 2353.940768][T13228]  __should_failslab+0x81/0x90
[ 2353.945634][T13228]  should_failslab+0x5/0x20
[ 2353.950177][T13228]  kmem_cache_alloc_node_trace+0x61/0x2e0
[ 2353.955905][T13228]  ? __kmalloc_node_track_caller+0x30/0x40
[ 2353.961713][T13228]  __kmalloc_node_track_caller+0x30/0x40
[ 2353.967400][T13228]  ? alloc_uevent_skb+0x5b/0x120
[ 2353.972465][T13228]  __alloc_skb+0x187/0x420
[ 2353.976936][T13228]  alloc_uevent_skb+0x5b/0x120
[ 2353.981770][T13228]  kobject_uevent_env+0x863/0xc40
[ 2353.986824][T13228]  ? kernfs_put+0x2e2/0x300
[ 2353.991405][T13228]  kobject_uevent+0x18/0x20
[ 2353.996052][T13228]  __loop_clr_fd+0x601/0x850
[ 2354.000645][T13228]  lo_ioctl+0xac5/0x13e0
[ 2354.004887][T13228]  ? cgroup_rstat_updated+0x34/0x100
[ 2354.010182][T13228]  ? drain_obj_stock+0x350/0x3f0
[ 2354.015243][T13228]  ? mod_objcg_state+0x53f/0x650
[ 2354.020184][T13228]  ? mod_objcg_state+0x3ff/0x650
[ 2354.025144][T13228]  ? avc_has_extended_perms+0x67d/0x8a0
[ 2354.030695][T13228]  ? blkdev_common_ioctl+0x438/0x1110
[ 2354.036091][T13228]  ? selinux_file_ioctl+0x981/0xa10
[ 2354.041365][T13228]  ? lo_release+0x120/0x120
[ 2354.045949][T13228]  blkdev_ioctl+0x1d0/0x3f0
[ 2354.050541][T13228]  block_ioctl+0x6e/0x80
[ 2354.054837][T13228]  ? blkdev_iopoll+0x80/0x80
[ 2354.059497][T13228]  __se_sys_ioctl+0xcb/0x140
[ 2354.064169][T13228]  __x64_sys_ioctl+0x3f/0x50
[ 2354.068753][T13228]  do_syscall_64+0x44/0xa0
[ 2354.073413][T13228]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 2354.079386][T13228] RIP: 0033:0x7fa77033c7f7
[ 2354.083851][T13228] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 04 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2354.103459][T13228] RSP: 002b:00007fa76e0b2fa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 2354.111867][T13228] RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007fa77033c7f7
[ 2354.119855][T13228] RDX: 0000000000000000 RSI: 0000000000004c01 RDI: 0000000000000005
01:50:55 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2354.127831][T13228] RBP: 00007fa76e0b36bc R08: 00007fa76e0b3040 R09: 0000000020000000
[ 2354.135839][T13228] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
[ 2354.143819][T13228] R13: 0000000000000016 R14: 00007fa76e0b3000 R15: 00000000200000c0
01:50:56 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x74000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:56 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xffffff7f}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2354.230462][T13385] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2354.334294][T13489] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2354.346670][T13490] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:50:56 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:56 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x9, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:50:56 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001040000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2354.382382][T13492] loop0: detected capacity change from 0 to 4096
[ 2354.402681][T13492] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2354.477706][T13699] loop5: detected capacity change from 0 to 16
[ 2354.485309][T13698] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2354.501919][T13699] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2354.501919][T13699] 
01:50:56 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x7a000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:56 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:50:56 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xffffff8c}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2354.525667][T13805] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:56 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:56 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x30, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2354.646344][T13909] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2354.658956][T13981] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2354.792452][T14016] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2354.812338][T14015] loop0: detected capacity change from 0 to 4096
[ 2354.826608][T14040] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:56 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x8cffffff}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2354.840995][T14058] loop5: detected capacity change from 0 to 16
[ 2354.853799][T14015] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:50:56 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xfffffff6}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2354.894137][T14058] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2354.894137][T14058] 
[ 2354.928312][T14319] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:50:56 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001050000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:50:56 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8cffffff, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:56 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xaa, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:50:56 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x3, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2354.950299][T14325] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2354.969432][T14058] loop5: detected capacity change from 0 to 16
[ 2354.980092][T14058] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2354.980092][T14058] 
01:50:56 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xb4000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2355.089500][T14428] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2355.168444][T14533] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:57 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xfffffffe}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2355.221030][T14635] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2355.235733][T14638] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2355.255689][T14671] loop5: detected capacity change from 0 to 16
01:50:57 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8030000, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2355.275873][T14671] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2355.275873][T14671] 
[ 2355.293340][T14695] loop0: detected capacity change from 0 to 4096
[ 2355.302278][T14671] loop5: detected capacity change from 0 to 16
[ 2355.310574][T14671] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2355.310574][T14671] 
01:50:57 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x300, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:50:57 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2355.331474][T14695] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2355.343214][T14743] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:57 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001060000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:50:57 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xf6ffffff}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2355.406226][T14904] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:57 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x200000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:57 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf6ffffff, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2355.469839][T15029] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2355.495790][T15058] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:50:57 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x900, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2355.585529][T15165] loop5: detected capacity change from 0 to 16
[ 2355.601674][T15165] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2355.601674][T15165] 
[ 2355.624926][T15168] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2355.637755][T15165] loop5: detected capacity change from 0 to 16
[ 2355.645460][T15165] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2355.645460][T15165] 
[ 2355.667172][T15198] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:57 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x5, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2355.693212][T15221] loop0: detected capacity change from 0 to 4096
[ 2355.708551][T15351] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2355.730758][T15221] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:50:57 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x800000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2355.766199][T15383] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:50:57 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xfeffffff}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:57 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001080000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:50:57 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:57 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x3000, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:50:57 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x1000001000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2355.916507][T15581] loop5: detected capacity change from 0 to 16
[ 2355.932912][T15582] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2355.948817][T15581] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2355.948817][T15581] 
01:50:57 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xffffff7f}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:57 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x6, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2355.994610][T15581] loop5: detected capacity change from 0 to 16
[ 2355.995888][T15684] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2356.014506][T15581] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2356.014506][T15581] 
01:50:57 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x6cf3, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2356.072776][T15792] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2356.105104][T15892] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:50:57 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:58 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001100000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2356.128748][T15893] loop0: detected capacity change from 0 to 4096
[ 2356.145628][T15893] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2356.217905][T15997] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:58 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x2000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2356.265463][T16100] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2356.299618][T16119] loop5: detected capacity change from 0 to 16
01:50:58 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xffffff8c}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2356.319429][T16269] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2356.340976][T16119] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2356.340976][T16119] 
01:50:58 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xf36c, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:50:58 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff8c, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2356.362715][T16311] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2356.383823][T16119] loop5: detected capacity change from 0 to 16
[ 2356.392633][T16119] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2356.392633][T16119] 
01:50:58 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x4000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:58 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x7, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2356.426789][T16313] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:58 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xfffffff6}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2356.565041][T16423] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2356.567055][T16420] loop0: detected capacity change from 0 to 4096
[ 2356.591334][T16420] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:50:58 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001180000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:50:58 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x30000, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2356.622279][T16551] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2356.639624][T16600] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:50:58 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff6, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2356.721522][T16736] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2356.741299][T16771] loop5: detected capacity change from 0 to 16
01:50:58 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x1000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2356.771949][T16771] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2356.771949][T16771] 
[ 2356.811853][T16771] loop5: detected capacity change from 0 to 16
01:50:58 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2356.818343][T16771] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2356.818343][T16771] 
[ 2356.841353][T16839] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:58 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xfffffffe}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:58 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x1000000, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:50:58 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2356.941878][T16942] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2356.959151][T17046] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:50:58 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001260000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2357.014824][T17048] loop0: detected capacity change from 0 to 4096
[ 2357.028916][T17048] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2357.048512][T17050] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:58 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x10000010000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2357.130747][T17255] loop5: detected capacity change from 0 to 16
[ 2357.160852][T17257] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2357.172955][T17255] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2357.172955][T17255] 
[ 2357.199634][T17389] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:50:59 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x200000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:59 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x2000000, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:50:59 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2357.230841][T17255] loop5: detected capacity change from 0 to 16
[ 2357.231684][T17438] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2357.238616][T17255] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2357.238616][T17255] 
01:50:59 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x9, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:50:59 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x40000100000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2357.309850][T17463] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2357.395181][T17566] loop0: detected capacity change from 0 to 4096
[ 2357.411493][T17568] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2357.428484][T17566] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:50:59 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001300000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:50:59 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x800000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2357.477587][T17771] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2357.492209][T17779] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:50:59 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x10}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:59 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x3000000, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2357.524707][T17878] loop5: detected capacity change from 0 to 16
[ 2357.549839][T17878] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2357.549839][T17878] 
[ 2357.579046][T17879] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:59 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x100000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2357.599846][T17878] loop5: detected capacity change from 0 to 16
[ 2357.607472][T17878] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2357.607472][T17878] 
01:50:59 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xa, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:50:59 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x1000001000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2357.696098][T17986] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:59 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x4000000, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2357.765610][T18125] loop0: detected capacity change from 0 to 4096
[ 2357.797843][T18125] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:50:59 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100017b0000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2358.023993][T18304] loop5: detected capacity change from 0 to 16
[ 2358.034099][T18306] loop0: detected capacity change from 0 to 4096
[ 2358.040708][T18302] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2358.052986][T18301] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:50:59 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x2000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:59 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x200000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:59 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x9000000, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2358.071834][T18304] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2358.071834][T18304] 
[ 2358.088957][T18306] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:50:59 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x2200}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:50:59 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100017e0000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2358.131782][T18304] loop5: detected capacity change from 0 to 16
[ 2358.147431][T18304] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2358.147431][T18304] 
01:51:00 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xb, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2358.250446][T18709] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:00 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x4000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:00 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x300000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2358.292297][T18812] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:00 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x30000000, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2358.546400][T19021] loop5: detected capacity change from 0 to 16
[ 2358.566122][T19020] loop0: detected capacity change from 0 to 4096
[ 2358.574973][T19021] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2358.574973][T19021] 
[ 2358.596968][T19023] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2358.611747][T19024] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2358.630578][T19021] loop5: detected capacity change from 0 to 16
01:51:00 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x80ffffff, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2358.637246][T19020] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2358.659409][T19021] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2358.659409][T19021] 
01:51:00 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x1000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:00 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xc, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:00 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4800}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:00 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x400000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:00 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x9effffff, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2358.777511][T19531] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:00 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x10000010000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:00 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001fe0000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2358.921704][T19637] loop5: detected capacity change from 0 to 16
[ 2358.929794][T19636] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2358.944421][T19638] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4800 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2358.956609][T19637] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2358.956609][T19637] 
01:51:00 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xaa000000, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:00 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x500000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:00 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c02}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2358.968454][T19720] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4800 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2359.002478][T19842] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2359.015276][T19637] loop5: detected capacity change from 0 to 16
[ 2359.026203][T19637] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2359.026203][T19637] 
01:51:00 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xd, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:00 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x40000100000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2359.067809][T19944] loop0: detected capacity change from 0 to 4096
[ 2359.105714][T19944] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:00 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001040200daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:00 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xeaffffff, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:01 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x600000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2359.221722][T20147] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2359.304949][T20253] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2359.342469][T20310] loop5: detected capacity change from 0 to 16
01:51:01 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x100000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:01 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c03}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2359.356929][T20310] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2359.356929][T20310] 
[ 2359.375032][T20369] loop0: detected capacity change from 0 to 4096
01:51:01 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xefffffff, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2359.410261][T20369] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2359.423265][T20310] loop5: detected capacity change from 0 to 16
[ 2359.432481][T20310] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2359.432481][T20310] 
[ 2359.448626][T20462] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:01 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000300daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:01 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xe, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:01 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x700000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2359.539291][T20664] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:01 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x200000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:01 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xf0ffffff, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:01 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c04}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2359.606211][T20849] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c03 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2359.631848][T20869] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c03 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2359.684876][T20872] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2359.702298][T20894] loop5: detected capacity change from 0 to 16
01:51:01 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x800000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2359.727430][T20894] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2359.727430][T20894] 
[ 2359.773621][T20894] loop5: detected capacity change from 0 to 16
[ 2359.780496][T20894] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2359.780496][T20894] 
[ 2359.797356][T20975] loop0: detected capacity change from 0 to 4096
01:51:01 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xf, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2359.818872][T20975] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2359.831379][T20979] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:01 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001020400daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2359.877144][T21143] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c04 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
01:51:01 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xf36c0000, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:01 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x300000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:01 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c05}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:01 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x900000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2359.930707][T21284] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2359.958348][T21285] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c04 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2359.997051][T21387] loop5: detected capacity change from 0 to 16
[ 2360.016384][T21387] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2360.016384][T21387] 
[ 2360.062827][T21387] loop5: detected capacity change from 0 to 16
[ 2360.072720][T21387] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2360.072720][T21387] 
01:51:01 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x10, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:01 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xfcffffff, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2360.139593][T21466] loop0: detected capacity change from 0 to 4096
[ 2360.180933][T21466] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:02 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001060400daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2360.237384][T21493] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2360.265362][T21497] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:02 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xfeffffff, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:02 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xa00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:02 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x400000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2360.304869][T21829] loop5: detected capacity change from 0 to 16
[ 2360.328208][T21829] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2360.328208][T21829] 
[ 2360.378571][T21829] loop5: detected capacity change from 0 to 16
[ 2360.390995][T21829] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2360.390995][T21829] 
01:51:02 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x11, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:02 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c06}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:02 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xffffff7f, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2360.467021][T21943] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2360.482010][T22002] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2360.508429][T22065] loop0: detected capacity change from 0 to 4096
01:51:02 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x500000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:02 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xb00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2360.533376][T22065] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:02 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2360.605016][T22363] loop5: detected capacity change from 0 to 16
[ 2360.632318][T22363] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2360.632318][T22363] 
01:51:02 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xffffff80, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2360.671977][T22363] loop5: detected capacity change from 0 to 16
[ 2360.695312][T22363] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2360.695312][T22363] 
01:51:02 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x12, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:02 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x600000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2360.743265][T22469] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2360.760383][T22470] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:02 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c07}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:02 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xc00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2360.810223][T22581] loop0: detected capacity change from 0 to 4096
[ 2360.846381][T22581] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:02 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xffffff9e, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:02 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000600daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2360.929095][T22881] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2360.968242][T22936] loop5: detected capacity change from 0 to 16
01:51:02 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x700000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2360.991891][T22936] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2360.991891][T22936] 
[ 2361.007933][T22985] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c07 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2361.031086][T22986] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:02 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c08}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:02 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xd00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:02 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x22, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2361.045389][T22987] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c07 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2361.057242][T22936] loop5: detected capacity change from 0 to 16
[ 2361.065309][T22936] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2361.065309][T22936] 
01:51:02 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xffffffea, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2361.166400][T23193] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2361.175715][T23192] loop0: detected capacity change from 0 to 4096
01:51:03 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x800000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2361.219766][T23192] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:03 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001040600daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2361.289250][T23299] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:03 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xe00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:03 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xffffffef, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2361.346121][T23507] loop5: detected capacity change from 0 to 16
[ 2361.368944][T23507] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2361.368944][T23507] 
01:51:03 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x25, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2361.403984][T23507] loop5: detected capacity change from 0 to 16
[ 2361.413781][T23507] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2361.413781][T23507] 
[ 2361.428921][T23506] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:03 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x900000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:03 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c09}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:03 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xfffffff0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2361.552515][T23712] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2361.570373][T23710] loop0: detected capacity change from 0 to 4096
[ 2361.614716][T23710] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2361.630551][T23881] loop5: detected capacity change from 0 to 16
[ 2361.653900][T23881] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2361.653900][T23881] 
01:51:03 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x1000000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2361.654477][T23932] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:03 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001001800daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:03 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c0a}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2361.709231][T23881] loop5: detected capacity change from 0 to 16
[ 2361.730747][T23881] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2361.730747][T23881] 
01:51:03 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xa00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:03 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xfffffffc, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2361.792685][T24229] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:03 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2e, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:03 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x1100000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2361.890098][T24333] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c0a ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2361.906397][T24332] loop0: detected capacity change from 0 to 4096
[ 2361.926491][T24336] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:03 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c0b}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2361.938916][T24338] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c0a ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2361.944967][T24332] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:03 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001002000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:03 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xb00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:03 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0xfffffffe, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2362.018626][T24647] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:03 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x1200000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2362.062538][T24680] loop5: detected capacity change from 0 to 16
[ 2362.075702][T24680] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2362.075702][T24680] 
[ 2362.112711][T24680] loop5: detected capacity change from 0 to 16
[ 2362.122808][T24680] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2362.122808][T24680] 
01:51:03 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x48, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:04 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xf, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2362.228348][T24808] loop0: detected capacity change from 0 to 4096
[ 2362.255548][T24756] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:04 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xc00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2362.273962][T24808] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2362.310446][T24865] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:04 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001002600daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:04 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c0c}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:04 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x2000000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2362.363445][T25096] loop5: detected capacity change from 0 to 16
[ 2362.379202][T25096] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2362.379202][T25096] 
01:51:04 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0x10, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2362.421919][T25096] loop5: detected capacity change from 0 to 16
[ 2362.428611][T25096] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2362.428611][T25096] 
01:51:04 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4c, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2362.522693][T25277] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c0c ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2362.535624][T25278] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c0c ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2362.560647][T25279] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:04 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c0d}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:04 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xc0, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2362.588283][T25281] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2362.591067][T25282] loop0: detected capacity change from 0 to 4096
01:51:04 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xd00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:04 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x2500000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2362.646836][T25282] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2362.678632][T25588] loop5: detected capacity change from 0 to 16
[ 2362.702128][T25588] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2362.702128][T25588] 
[ 2362.740069][T25691] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c0d ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
01:51:04 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001003000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2362.760943][T25588] loop5: detected capacity change from 0 to 16
[ 2362.774736][T25588] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2362.774736][T25588] 
[ 2362.785103][T25694] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c0d ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
01:51:04 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c0e}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:04 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0x2c0, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:04 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x60, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2362.812241][T25749] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2362.840218][T25791] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:04 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x2700000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:04 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xe00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:04 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c10}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2362.937054][T26001] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c0e ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2362.952118][T26002] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c0e ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2362.995315][T26004] loop0: detected capacity change from 0 to 4096
[ 2363.023452][T26004] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2363.036672][T26110] loop5: detected capacity change from 0 to 16
01:51:04 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xec0, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2363.036709][T26109] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2363.064508][T26110] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2363.064508][T26110] 
[ 2363.074628][T26152] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:04 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x4800000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2363.102242][T26110] loop5: detected capacity change from 0 to 16
[ 2363.109034][T26110] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2363.109034][T26110] 
01:51:04 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001003f00daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:04 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x1000000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:05 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x68, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:05 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c11}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2363.159563][T26416] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c10 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2363.182396][T26417] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c10 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
01:51:05 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0x33fe0, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:05 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x4c00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2363.296394][T26521] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2363.332029][T26621] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:05 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x1100000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2363.392412][T26728] loop5: detected capacity change from 0 to 16
[ 2363.419490][T26729] loop0: detected capacity change from 0 to 4096
[ 2363.426696][T26728] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2363.426696][T26728] 
01:51:05 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0x200000b8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:05 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x6c, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:05 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001004000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2363.464335][T26729] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2363.477304][T26728] loop5: detected capacity change from 0 to 16
[ 2363.487497][T26728] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2363.487497][T26728] 
01:51:05 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c12}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2363.587803][T26849] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2363.619734][T27013] loop5: detected capacity change from 0 to 16
[ 2363.621462][T27016] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:05 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x6000000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:05 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0x7ffff000, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:05 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x1200000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2363.651846][T27013] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2363.651846][T27013] 
[ 2363.726656][T27013] loop5: detected capacity change from 0 to 16
[ 2363.733383][T27013] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2363.733383][T27013] 
01:51:05 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x74, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2363.777189][T27248] loop0: detected capacity change from 0 to 4096
[ 2363.808383][T27248] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:05 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001007b00daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:05 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xfffffdef, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2363.873316][T27403] loop5: detected capacity change from 0 to 16
[ 2363.892223][T27403] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2363.892223][T27403] 
[ 2363.922687][T27403] loop5: detected capacity change from 0 to 16
[ 2363.931372][T27403] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2363.931372][T27403] 
01:51:05 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x7a, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:05 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x6800000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2363.974435][T27405] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2363.986213][T27404] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:05 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x2000000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:05 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x10, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:05 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c16}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2364.067329][T27733] loop0: detected capacity change from 0 to 4096
[ 2364.094600][T27733] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:05 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001007e00daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2364.148842][T27871] loop5: detected capacity change from 0 to 16
[ 2364.175132][T27871] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2364.175132][T27871] 
[ 2364.189446][T27873] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2364.206926][T27877] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:06 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x6c00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:06 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x2500000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:06 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x11, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2364.257515][T27871] loop5: detected capacity change from 0 to 16
[ 2364.272183][T27871] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2364.272183][T27871] 
01:51:06 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xfd, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2364.405172][T28188] loop0: detected capacity change from 0 to 4096
[ 2364.430188][T28187] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:06 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x7400000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2364.453694][T28188] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2364.467162][T28241] loop5: detected capacity change from 0 to 16
[ 2364.477380][T28295] netlink: 144 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 2364.493864][T28241] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2364.493864][T28241] 
01:51:06 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c25}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:06 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001fffe00daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2364.515391][T28294] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2364.531627][T28241] loop5: detected capacity change from 0 to 16
[ 2364.545612][T28241] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2364.545612][T28241] 
01:51:06 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x2700000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:06 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xfe, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:06 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x12, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2364.578881][T28597] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:06 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x7a00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2364.752304][T28704] netlink: 144 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 2364.766298][T28705] loop0: detected capacity change from 0 to 4096
01:51:06 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2364.794820][T28703] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2364.814231][T28705] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2364.826299][T28811] loop5: detected capacity change from 0 to 16
01:51:06 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c27}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:06 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x4800000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2364.854494][T28809] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2364.890044][T28811] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2364.890044][T28811] 
01:51:06 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001feff00daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:06 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:06 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x8a03000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2364.967768][T28811] loop5: detected capacity change from 0 to 16
[ 2364.975291][T28811] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2364.975291][T28811] 
01:51:06 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x102, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:06 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c48}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2365.052544][T29230] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c27 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2365.065198][T29229] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2365.079065][T29231] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c27 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
01:51:06 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x4a03000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2365.138848][T29339] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2365.159490][T29362] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 2365.171988][T29338] loop0: detected capacity change from 0 to 4096
01:51:07 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x8c02000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:07 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2365.189277][T29442] loop5: detected capacity change from 0 to 16
[ 2365.191156][T29338] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2365.222629][T29442] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2365.222629][T29442] 
01:51:07 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000200daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2365.272265][T29442] loop5: detected capacity change from 0 to 16
[ 2365.283844][T29442] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2365.283844][T29442] 
01:51:07 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x103, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2365.331806][T29647] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:07 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x4c00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2365.376463][T29668] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.2'.
01:51:07 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x16, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2365.607059][T29654] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2365.630950][T29875] loop5: detected capacity change from 0 to 16
01:51:07 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x8cffffff00000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2365.655281][T29875] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2365.655281][T29875] 
[ 2365.669167][T29953] loop0: detected capacity change from 0 to 4096
01:51:07 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x18, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2365.698667][T29953] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2365.721269][T29875] loop5: detected capacity change from 0 to 16
[ 2365.730901][T29876] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2365.742882][T29875] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2365.742882][T29875] 
01:51:07 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x17a, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:07 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000300daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:07 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c4c}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:07 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x6000000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:07 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x1b, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2365.896733][T30267] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:07 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xf6ffffff00000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2365.974287][T30470] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2366.000405][T30486] loop5: detected capacity change from 0 to 16
[ 2366.016749][T30486] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2366.016749][T30486] 
[ 2366.018195][T30556] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c4c ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2366.045147][T30557] loop0: detected capacity change from 0 to 4096
[ 2366.055343][T30576] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c4c ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
01:51:07 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x6800000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:07 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c60}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2366.079370][T30557] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2366.102498][T30486] loop5: detected capacity change from 0 to 16
[ 2366.112192][T30486] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2366.112192][T30486] 
01:51:07 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x1d, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2366.130205][T30669] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:08 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xfeffffff00000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:08 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000400daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:08 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1a0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2366.391966][T30885] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2366.403856][T30890] netlink: 168 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 2366.410562][T30892] loop5: detected capacity change from 0 to 16
[ 2366.430426][T30894] loop0: detected capacity change from 0 to 4096
01:51:08 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x28, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:08 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x6c00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2366.450985][T30892] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2366.450985][T30892] 
[ 2366.474692][T30894] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2366.487920][T30892] loop5: detected capacity change from 0 to 16
01:51:08 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x201, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:08 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2366.509047][T30892] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2366.509047][T30892] 
[ 2366.518863][T30891] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:08 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xffffff7f00000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:08 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c68}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2366.639719][T31300] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2366.655988][T31302] netlink: 164 bytes leftover after parsing attributes in process `syz-executor.2'.
01:51:08 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x2, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:08 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x7400000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2366.690675][T31480] loop5: detected capacity change from 0 to 16
[ 2366.715991][T31480] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2366.715991][T31480] 
[ 2366.728517][T31506] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:08 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xffffffff00000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2366.774673][T31560] loop0: detected capacity change from 0 to 4096
[ 2366.793168][T31480] loop5: detected capacity change from 0 to 16
[ 2366.802336][T31480] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2366.802336][T31480] 
[ 2366.813952][T31560] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:08 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x203, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:08 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000600daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:08 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x3, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2366.971516][T31714] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2366.996233][T31720] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:08 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xffffffffffffffff}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:08 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c6c}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:08 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x7a00000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2367.046098][T31943] loop5: detected capacity change from 0 to 16
[ 2367.068591][T31943] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2367.068591][T31943] 
[ 2367.113620][T32020] loop0: detected capacity change from 0 to 4096
[ 2367.126871][T32020] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2367.140469][T31943] loop5: detected capacity change from 0 to 16
[ 2367.152619][T31943] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2367.152619][T31943] 
01:51:09 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000800daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:09 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x204, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2367.207201][T32227] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:09 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x8, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2367.252730][T32229] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c6c ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2367.266732][T32230] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2367.281519][T32239] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c6c ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
01:51:09 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c74}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:09 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:09 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x8cffffff00000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2367.381525][T32437] loop5: detected capacity change from 0 to 16
[ 2367.398861][T32436] loop0: detected capacity change from 0 to 4096
[ 2367.405912][T32437] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2367.405912][T32437] 
01:51:09 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x19, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2367.431927][T32437] loop5: detected capacity change from 0 to 16
[ 2367.436295][T32436] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2367.450519][T32437] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2367.450519][T32437] 
01:51:09 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001001000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:09 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2fc, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2367.486217][T32593] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c74 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2367.503886][T32643] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:09 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x2}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:09 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c7a}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2367.542406][T32655] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c74 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2367.574235][  T306] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:09 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x300, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:09 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xb400000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2367.666242][  T528] loop5: detected capacity change from 0 to 16
[ 2367.701098][  T528] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2367.701098][  T528] 
01:51:09 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2fd, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:09 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:09 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2367.728957][  T533] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2367.743139][  T528] loop5: detected capacity change from 0 to 16
[ 2367.750163][  T528] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2367.750163][  T528] 
[ 2367.764963][  T534] loop0: detected capacity change from 0 to 4096
01:51:09 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001001800daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2367.819803][  T534] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2368.150703][  T844] loop5: detected capacity change from 0 to 16
[ 2368.168274][  T844] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2368.168274][  T844] 
[ 2368.182972][  T848] loop0: detected capacity change from 0 to 4096
01:51:10 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x2, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:10 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001002600daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2368.211228][  T848] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2368.223827][  T844] loop5: detected capacity change from 0 to 16
[ 2368.234534][  T844] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2368.234534][  T844] 
01:51:10 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x300, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:10 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2368.314717][  T845] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2368.339385][  T846] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:10 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:10 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x3, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:10 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xf6ffffff00000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2368.415364][ T1354] loop5: detected capacity change from 0 to 16
[ 2368.440103][ T1354] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2368.440103][ T1354] 
01:51:10 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x7400}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2368.464346][ T1356] ref_ctr_offset mismatch. inode: 0x46f offset: 0x6c00 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2368.476987][ T1354] loop5: detected capacity change from 0 to 16
[ 2368.482409][ T1358] ref_ctr_offset mismatch. inode: 0x46f offset: 0x6c00 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2368.495360][ T1354] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2368.495360][ T1354] 
[ 2368.529143][ T1359] loop0: detected capacity change from 0 to 4096
[ 2368.552427][ T1359] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2368.568839][ T1365] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:10 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x301, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:10 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001003000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:10 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x4, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2368.616326][ T1366] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:10 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xfeffffff00000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:10 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:10 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x9, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2368.788287][ T1773] loop5: detected capacity change from 0 to 16
[ 2368.813902][ T1773] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2368.813902][ T1773] 
[ 2368.867901][ T1876] loop0: detected capacity change from 0 to 4096
[ 2368.874922][ T1877] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2368.894242][ T1773] loop5: detected capacity change from 0 to 16
[ 2368.910070][ T1773] EXT4-fs (loop5): invalid inodes per group: 1376259
01:51:10 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xffffff7f00000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:10 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x302, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:10 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001007b00daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2368.910070][ T1773] 
[ 2368.923599][ T1876] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:10 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x7a00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2369.037911][ T1958] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2369.065144][ T2129] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2369.081985][ T2163] loop5: detected capacity change from 0 to 16
01:51:10 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x6}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2369.108920][ T2163] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2369.108920][ T2163] 
[ 2369.145077][ T2389] loop0: detected capacity change from 0 to 4096
01:51:10 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x30, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2369.156529][ T2163] loop5: detected capacity change from 0 to 16
[ 2369.169946][ T2163] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2369.169946][ T2163] 
01:51:11 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xffffffff00000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:11 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x3c1, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:11 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x1dad70}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2369.205461][ T2392] ref_ctr_offset mismatch. inode: 0x46f offset: 0x7a00 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
[ 2369.206226][ T2389] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2369.240844][ T2393] ref_ctr_offset mismatch. inode: 0x46f offset: 0x7a00 ref_ctr_offset(old): 0x6 ref_ctr_offset(new): 0x4
01:51:11 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001007e00daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:11 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x7}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2369.281962][ T2496] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:11 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xaa, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2369.343479][ T2699] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:11 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xffffffffffffffff}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:11 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x2}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2369.386729][ T2806] loop5: detected capacity change from 0 to 16
[ 2369.411688][ T2806] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2369.411688][ T2806] 
[ 2369.451964][ T2806] loop5: detected capacity change from 0 to 16
[ 2369.461808][ T2806] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2369.461808][ T2806] 
[ 2369.477763][ T2811] loop0: detected capacity change from 0 to 4096
01:51:11 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x300, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2369.491931][ T2812] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2369.503310][ T2811] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:11 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x402, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:11 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000100fe00daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2369.542240][ T2918] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2369.562700][ T2995] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:11 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2369.609261][ T3125] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:11 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x2}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:11 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:11 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x900, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2369.662283][ T3328] loop5: detected capacity change from 0 to 16
[ 2369.683503][ T3328] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2369.683503][ T3328] 
01:51:11 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x406, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2369.721757][ T3328] loop5: detected capacity change from 0 to 16
[ 2369.728723][ T3328] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2369.728723][ T3328] 
[ 2369.800126][ T3332] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2369.825738][ T3333] loop0: detected capacity change from 0 to 4096
[ 2369.833725][ T3355] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:11 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x9}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:11 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:11 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000402daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2369.861436][ T3333] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2369.876015][ T3446] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2369.894338][ T3562] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:11 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:11 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x3000, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2370.025227][ T3763] loop5: detected capacity change from 0 to 16
[ 2370.050810][ T3763] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2370.050810][ T3763] 
[ 2370.080284][ T3767] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2370.113367][ T3833] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2370.120896][ T3763] loop5: detected capacity change from 0 to 16
01:51:11 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xa}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:11 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x6cf3, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2370.136337][ T3763] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2370.136337][ T3763] 
[ 2370.158507][ T3963] loop0: detected capacity change from 0 to 4096
[ 2370.161421][ T3836] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:12 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:12 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x410, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:12 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x5}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2370.181850][ T4003] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2370.203254][ T3963] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:12 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000003daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:12 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xf36c, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2370.291782][ T4226] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2370.327267][ T4327] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:12 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xb}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2370.371123][ T4475] loop5: detected capacity change from 0 to 16
[ 2370.403515][ T4475] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2370.403515][ T4475] 
[ 2370.415439][ T4544] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2370.443951][ T4546] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2370.459300][ T4475] loop5: detected capacity change from 0 to 16
01:51:12 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x5}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2370.466067][ T4475] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2370.466067][ T4475] 
01:51:12 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x6}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:12 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x30000, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:12 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x500, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2370.523378][ T4654] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2370.543298][ T4653] loop0: detected capacity change from 0 to 4096
[ 2370.555225][ T4657] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2370.572250][ T4653] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:12 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x6}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:12 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xc}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2370.648941][ T4888] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:12 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000204daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:12 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x1000000, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2370.690692][ T5023] loop5: detected capacity change from 0 to 16
[ 2370.703349][ T5012] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:12 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x7}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2370.750315][ T5023] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2370.750315][ T5023] 
[ 2370.793212][ T5069] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2370.806884][ T5023] loop5: detected capacity change from 0 to 16
[ 2370.815427][ T5023] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2370.815427][ T5023] 
[ 2370.816595][ T5070] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:12 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x7}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:12 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x600, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:12 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xd}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:12 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x2000000, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2370.925139][ T5351] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2370.952412][ T5381] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2370.966434][ T5380] loop0: detected capacity change from 0 to 4096
01:51:12 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2370.984404][ T5380] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2371.018423][ T5387] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2371.034405][ T5403] loop5: detected capacity change from 0 to 16
[ 2371.034591][ T5402] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2371.055550][ T5403] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2371.055550][ T5403] 
01:51:12 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000604daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:12 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:12 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xe}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:12 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x3000000, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2371.118889][ T5774] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2371.148766][ T5403] loop5: detected capacity change from 0 to 16
[ 2371.156907][ T5403] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2371.156907][ T5403] 
01:51:12 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x9}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:13 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x604, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2371.166237][ T5793] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2371.288986][ T5799] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2371.305974][ T5806] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2371.332172][ T5919] loop0: detected capacity change from 0 to 4096
01:51:13 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x10}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:13 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x4000000, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2371.348618][ T5920] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2371.364084][ T5919] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2371.384663][ T6027] loop5: detected capacity change from 0 to 16
01:51:13 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x9}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2371.406955][ T6027] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2371.406955][ T6027] 
[ 2371.418645][ T6108] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:13 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000005daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:13 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xa}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2371.453964][ T6184] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2371.482617][ T6027] loop5: detected capacity change from 0 to 16
[ 2371.497164][ T6027] EXT4-fs (loop5): invalid inodes per group: 1376259
01:51:13 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x9000000, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:13 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x11}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2371.497164][ T6027] 
[ 2371.514792][ T6414] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:13 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x700, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:13 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xa}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2371.567250][ T6517] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:13 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xb}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2371.613262][ T6519] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2371.651943][ T6522] loop0: detected capacity change from 0 to 4096
01:51:13 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x30000000, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2371.663176][ T6604] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2371.684397][ T6522] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:13 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x12}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:13 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000006daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2371.728992][ T6799] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2371.741581][ T6800] loop5: detected capacity change from 0 to 16
[ 2371.761801][ T6800] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2371.761801][ T6800] 
[ 2371.775832][ T6863] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2371.788964][ T6914] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:13 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xc}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2371.821619][ T6800] loop5: detected capacity change from 0 to 16
[ 2371.833165][ T6800] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2371.833165][ T6800] 
[ 2371.851794][ T7000] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:13 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xb}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:13 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x80ffffff, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:13 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x900, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:13 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x25}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2371.902122][ T7055] loop0: detected capacity change from 0 to 4096
[ 2371.932952][ T7055] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:13 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000406daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:13 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xd}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2371.973728][ T7205] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2371.988718][ T7218] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2372.049101][ T7264] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2372.096264][ T7435] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2372.124404][ T7469] loop5: detected capacity change from 0 to 16
01:51:13 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x9effffff, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2372.148545][ T7469] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2372.148545][ T7469] 
[ 2372.169133][ T7555] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:14 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xc}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:14 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x27}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2372.209501][ T7573] loop0: detected capacity change from 0 to 4096
[ 2372.221350][ T7469] loop5: detected capacity change from 0 to 16
[ 2372.230528][ T7575] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2372.243025][ T7469] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2372.243025][ T7469] 
01:51:14 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xe}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2372.258693][ T7573] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:14 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xa00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:14 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000018daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:14 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xaa000000, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2372.319150][ T7779] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:14 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x48}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2372.364070][ T7882] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2372.391529][ T7883] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:14 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x10}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:14 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xd}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2372.407503][ T7892] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2372.466149][ T7990] loop5: detected capacity change from 0 to 16
[ 2372.482535][ T7990] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2372.482535][ T7990] 
[ 2372.514356][ T8039] loop0: detected capacity change from 0 to 4096
[ 2372.536677][ T8098] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2372.549197][ T7990] loop5: detected capacity change from 0 to 16
01:51:14 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xeaffffff, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2372.551401][ T8039] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2372.567767][ T7990] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2372.567767][ T7990] 
[ 2372.577153][ T8099] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2372.600477][ T8139] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:14 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xb00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:14 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x4c}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2372.657072][ T8135] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:14 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000020daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:14 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x11}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:14 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xefffffff, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:14 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xe}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2372.747256][ T8509] loop5: detected capacity change from 0 to 16
[ 2372.765430][ T8510] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2372.790484][ T8509] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2372.790484][ T8509] 
01:51:14 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x60}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2372.831714][ T8509] loop5: detected capacity change from 0 to 16
[ 2372.850547][ T8509] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2372.850547][ T8509] 
[ 2372.870558][ T8614] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2372.882184][ T8615] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2372.896299][ T8623] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:14 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xc00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:14 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x12}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:14 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xf0ffffff, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:14 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x10}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2372.936260][ T8792] loop0: detected capacity change from 0 to 4096
[ 2372.979431][ T8792] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2372.998084][ T8822] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:14 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000026daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:14 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x68}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2373.076073][ T9051] loop5: detected capacity change from 0 to 16
[ 2373.076530][ T9052] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2373.099034][ T9051] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2373.099034][ T9051] 
[ 2373.101242][ T9118] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:14 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xf36c0000, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:14 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x16}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:14 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x11}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2373.132680][ T9133] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2373.153260][ T9051] loop5: detected capacity change from 0 to 16
[ 2373.161556][ T9051] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2373.161556][ T9051] 
01:51:15 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xd00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2373.254116][ T9235] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:15 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x6c}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2373.300171][ T9343] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2373.321658][ T9341] loop0: detected capacity change from 0 to 4096
[ 2373.339456][ T9440] loop5: detected capacity change from 0 to 16
01:51:15 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xfcffffff, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2373.350778][ T9370] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2373.364120][ T9440] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2373.364120][ T9440] 
[ 2373.375749][ T9341] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2373.387312][ T9449] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:15 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x25}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:15 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x12}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:15 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x74}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2373.412800][ T9471] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2373.434865][ T9440] loop5: detected capacity change from 0 to 16
[ 2373.452046][ T9440] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2373.452046][ T9440] 
01:51:15 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xfeffffff, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:15 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000030daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:15 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xe00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:15 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x27}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2373.550241][ T9854] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2373.562849][ T9855] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2373.610160][ T9859] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2373.627733][ T9860] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2373.639601][ T9896] loop5: detected capacity change from 0 to 16
01:51:15 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xffffff7f, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2373.665417][ T9896] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2373.665417][ T9896] 
01:51:15 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x7a}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2373.712332][T10166] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2373.726677][ T9896] loop5: detected capacity change from 0 to 16
[ 2373.743594][T10167] loop0: detected capacity change from 0 to 4096
01:51:15 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x25}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2373.757434][ T9896] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2373.757434][ T9896] 
[ 2373.757498][T10168] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:15 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x48}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:15 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xf00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2373.802693][T10167] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:15 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xffffff80, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:15 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000100003fdaf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2373.904072][T10375] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2373.940376][T10436] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:15 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x28c}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2373.955493][T10450] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2373.971212][T10464] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2373.986129][T10480] loop5: detected capacity change from 0 to 16
01:51:15 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x4c}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2374.017689][T10480] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2374.017689][T10480] 
[ 2374.062734][T10480] loop5: detected capacity change from 0 to 16
[ 2374.080155][T10480] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2374.080155][T10480] 
[ 2374.091910][T10645] loop0: detected capacity change from 0 to 4096
01:51:15 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x27}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:15 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1004, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2374.128921][T10693] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2374.141681][T10645] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:15 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xffffff9e, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:16 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x300}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:16 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000040daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2374.173440][T10694] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2374.194901][T10737] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:16 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x60}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2374.272549][T10899] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2374.305275][T10998] loop5: detected capacity change from 0 to 16
01:51:16 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x48}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:16 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xffffffea, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2374.334038][T10998] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2374.334038][T10998] 
[ 2374.345269][T11105] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2374.370722][T11106] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:16 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x38a}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2374.397601][T11125] loop0: detected capacity change from 0 to 4096
[ 2374.405155][T11163] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2374.423627][T10998] loop5: detected capacity change from 0 to 16
[ 2374.425936][T11125] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:16 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x68}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:16 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1020, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2374.445469][T10998] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2374.445469][T10998] 
01:51:16 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000100007bdaf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:16 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xffffffef, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2374.509662][T11378] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2374.564209][T11517] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2374.607531][T11518] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2374.633395][T11552] loop5: detected capacity change from 0 to 16
[ 2374.644173][T11567] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:16 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x4c}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:16 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xfffffff0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:16 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x500}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:16 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x6c}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2374.674849][T11552] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2374.674849][T11552] 
[ 2374.732838][T11725] loop0: detected capacity change from 0 to 4096
[ 2374.741907][T11552] loop5: detected capacity change from 0 to 16
[ 2374.751014][T11552] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2374.751014][T11552] 
[ 2374.755834][T11725] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:16 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1100, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2374.825585][T11808] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2374.843657][T11820] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:16 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000100007edaf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2374.907816][T12018] loop5: detected capacity change from 0 to 16
[ 2374.918876][T11863] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:16 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x60}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:16 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xfffffffc, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:16 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x600}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:16 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x74}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2374.950493][T12075] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2374.965866][T12018] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2374.965866][T12018] 
[ 2375.023222][T12018] loop5: detected capacity change from 0 to 16
[ 2375.030931][T12018] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2375.030931][T12018] 
01:51:16 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1200, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2375.083515][T12145] loop0: detected capacity change from 0 to 4096
[ 2375.096732][T12184] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2375.130150][T12287] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2375.146980][T12145] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:16 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0xfffffffe, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:17 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x68}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:17 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x700}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:17 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x7a}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2375.179655][T12269] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2375.197053][T12354] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2375.221757][T12482] loop5: detected capacity change from 0 to 16
01:51:17 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000100fffedaf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2375.248992][T12482] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2375.248992][T12482] 
[ 2375.282523][T12482] loop5: detected capacity change from 0 to 16
[ 2375.290168][T12482] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2375.290168][T12482] 
[ 2375.326576][T12558] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:17 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:17 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:17 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x6c}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2375.376557][T12665] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2375.402430][T12767] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:17 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x900}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:17 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x300}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2375.436814][T12843] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2375.473477][T12872] loop0: detected capacity change from 0 to 4096
01:51:17 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000100feffdaf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2375.486254][T12872] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2375.544322][T13000] loop5: detected capacity change from 0 to 16
[ 2375.565780][T13000] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2375.565780][T13000] 
[ 2375.587150][T13079] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2375.603558][T13000] loop5: detected capacity change from 0 to 16
[ 2375.619280][T13000] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2375.619280][T13000] 
[ 2375.633688][T13101] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:17 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x2, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:17 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2010, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:17 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x74}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:17 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xa00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:17 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x3e8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2375.672586][T13240] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2375.701802][T13284] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2375.764997][T13287] loop0: detected capacity change from 0 to 4096
[ 2375.781616][T13287] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:17 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000002daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2375.840840][T13493] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2375.860558][T13496] loop5: detected capacity change from 0 to 16
[ 2375.875199][T13495] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:17 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x3, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2375.890986][T13497] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2375.903294][T13496] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2375.903294][T13496] 
[ 2375.913909][T13595] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:17 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xb00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:17 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x500}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:17 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x7a}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2375.952065][T13496] loop5: detected capacity change from 0 to 16
[ 2375.982976][T13496] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2375.982976][T13496] 
01:51:17 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x4, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:17 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2200, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2376.084207][T13810] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2376.101818][T13811] loop0: detected capacity change from 0 to 4096
[ 2376.102252][T13820] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2376.123594][T13893] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:17 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xc00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2376.144326][T13811] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:18 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000003daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:18 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x600}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:18 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x9, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2376.183715][T14059] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:18 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xb4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2376.235218][T14144] loop5: detected capacity change from 0 to 17
[ 2376.251088][T14144] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2376.251088][T14144] 
[ 2376.267495][T14217] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:18 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xd00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2376.293514][T14144] loop5: detected capacity change from 0 to 17
[ 2376.300441][T14144] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2376.300441][T14144] 
[ 2376.319690][T14322] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:18 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x700}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:18 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2500, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2376.341237][T14329] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:18 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x30, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2376.420233][T14433] loop0: detected capacity change from 0 to 4096
[ 2376.437331][T14434] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:18 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x300}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2376.466389][T14433] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2376.474589][T14475] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2376.506770][T14545] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:18 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000004daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:18 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x900}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:18 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xe00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2376.529446][T14644] loop5: detected capacity change from 0 to 18
[ 2376.532013][T14643] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2376.558590][T14644] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2376.558590][T14644] 
01:51:18 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xaa, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2376.601830][T14644] loop5: detected capacity change from 0 to 18
[ 2376.608827][T14644] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2376.608827][T14644] 
01:51:18 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2e00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2376.656339][T14850] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:18 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x34a}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2376.727646][T14957] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2376.742082][T14959] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2376.755332][T14970] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:18 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xa00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:18 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x1100}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2376.776560][T14958] loop0: detected capacity change from 0 to 4096
01:51:18 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x300, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2376.809749][T14958] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:18 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000005daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2376.866094][T15273] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2376.882378][T15278] loop5: detected capacity change from 0 to 23
[ 2376.899500][T15278] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2376.899500][T15278] 
[ 2376.924195][T15345] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2376.941549][T15353] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2376.954193][T15278] loop5: detected capacity change from 0 to 23
[ 2376.961409][T15278] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2376.961409][T15278] 
01:51:18 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x3f00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2376.987542][T15413] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:18 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x900, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:18 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x1200}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:18 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x500}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:18 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xb00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2377.057859][T15584] loop0: detected capacity change from 0 to 4096
[ 2377.086816][T15584] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:18 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000006daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2377.172977][T15690] loop5: detected capacity change from 0 to 31
[ 2377.183738][T15691] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2377.200509][T15690] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2377.200509][T15690] 
[ 2377.214941][T15717] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2377.228953][T15738] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2377.242609][T15690] loop5: detected capacity change from 0 to 31
[ 2377.251881][T15762] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:19 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xc00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:19 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x3000, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:19 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x2000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2377.267771][T15690] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2377.267771][T15690] 
01:51:19 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x600}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:19 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2377.366457][T16000] loop0: detected capacity change from 0 to 4096
[ 2377.392068][T16000] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2377.396961][T16006] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2377.418095][T16005] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2377.432841][T16010] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:19 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000008daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:19 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x2500}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2377.468701][T16310] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:19 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xd00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:19 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x6cf3, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2377.521358][T16319] loop5: detected capacity change from 0 to 32
[ 2377.538241][T16319] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2377.538241][T16319] 
01:51:19 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x700}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2377.573168][T16319] loop5: detected capacity change from 0 to 32
[ 2377.581664][T16319] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2377.581664][T16319] 
01:51:19 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4800, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2377.655775][T16427] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2377.675154][T16445] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2377.688173][T16574] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:19 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x2700}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:19 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xf36c, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:19 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xe00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2377.719695][T16446] loop0: detected capacity change from 0 to 4096
[ 2377.751609][T16446] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:19 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000018daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2377.765380][T16637] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:19 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x900}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2377.850445][T16840] loop5: detected capacity change from 0 to 36
[ 2377.873426][T16840] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2377.873426][T16840] 
[ 2377.890156][T16844] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2377.922072][T16840] loop5: detected capacity change from 0 to 36
[ 2377.930281][T17003] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2377.952067][T16840] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2377.952067][T16840] 
01:51:19 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x4800}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:19 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x30000, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2377.964105][T17049] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2377.990852][T17050] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:19 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x1100}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:19 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4c00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:19 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xa00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2378.032934][T17133] loop0: detected capacity change from 0 to 4096
[ 2378.053108][T17133] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:19 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000026daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2378.109791][T17259] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:19 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x1000000, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:20 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x1200}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:20 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x4c00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2378.180878][T17419] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2378.197859][T17431] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2378.221062][T17466] loop5: detected capacity change from 0 to 38
[ 2378.240084][T17466] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2378.240084][T17466] 
[ 2378.254820][T17467] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2378.282564][T17466] loop5: detected capacity change from 0 to 38
01:51:20 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xb00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2378.289361][T17466] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2378.289361][T17466] 
01:51:20 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x6000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:20 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x2000000, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2378.380351][T17669] loop0: detected capacity change from 0 to 4096
[ 2378.387717][T17674] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2378.405940][T17696] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2378.407004][T17669] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:20 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x6000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:20 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x1600}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:20 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000030daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2378.441442][T17778] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2378.484462][T17881] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:20 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xc00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2378.557696][T17988] loop5: detected capacity change from 0 to 48
[ 2378.581561][T17988] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2378.581561][T17988] 
[ 2378.595120][T18002] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:20 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x6800}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2378.625569][T17988] loop5: detected capacity change from 0 to 48
[ 2378.635643][T18197] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2378.656049][T18198] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2378.667808][T17988] EXT4-fs (loop5): invalid inodes per group: 1376259
01:51:20 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x2000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:20 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x3000000, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:20 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x6800, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2378.667808][T17988] 
[ 2378.695229][T18199] loop0: detected capacity change from 0 to 4096
[ 2378.717141][T18199] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:20 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000100007bdaf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2378.750265][T18274] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:20 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xd00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2378.821250][T18406] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2378.848512][T18409] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:20 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x2500}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:20 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x6c00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2378.865647][T18428] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2378.880957][T18477] loop5: detected capacity change from 0 to 52
[ 2378.899282][T18477] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2378.899282][T18477] 
01:51:20 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x4000000, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2378.941739][T18477] loop5: detected capacity change from 0 to 52
[ 2378.948492][T18477] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2378.948492][T18477] 
01:51:20 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x6c00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2379.030400][T18615] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2379.057844][T18614] loop0: detected capacity change from 0 to 4096
01:51:20 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xe00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2379.081384][T18720] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2379.098903][T18614] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:20 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x2700}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:20 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000100007edaf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2379.122221][T18730] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2379.135390][T18805] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2379.164821][T18973] loop5: detected capacity change from 0 to 54
01:51:21 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x9000000, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:21 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x7400}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2379.193219][T18973] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2379.193219][T18973] 
[ 2379.232145][T18973] loop5: detected capacity change from 0 to 54
[ 2379.240202][T18973] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2379.240202][T18973] 
01:51:21 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x7400, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2379.301319][T19029] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:21 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x1100}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2379.341056][T19132] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2379.364575][T19134] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2379.389259][T19189] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:21 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x7a00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:21 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x30000000, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:21 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x4800}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2379.404177][T19190] loop0: detected capacity change from 0 to 4096
[ 2379.437122][T19190] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:21 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100010000fedaf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2379.476913][T19422] loop5: detected capacity change from 0 to 58
[ 2379.495640][T19422] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2379.495640][T19422] 
[ 2379.527785][T19443] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2379.551855][T19469] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2379.566295][T19422] loop5: detected capacity change from 0 to 58
[ 2379.591796][T19422] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2379.591796][T19422] 
[ 2379.608362][T19688] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:21 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x8a03}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:21 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x80ffffff, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:21 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x1200}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:21 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x7a00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2379.637803][T19750] loop0: detected capacity change from 0 to 4096
[ 2379.659105][T19750] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2379.673215][T19752] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:21 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x4c00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:21 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4795f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2379.743214][T19855] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2379.777508][T19932] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:21 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x8c02}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:21 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x9effffff, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2379.814775][T20088] loop5: detected capacity change from 0 to 61
[ 2379.842641][T20147] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2379.855385][T20088] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2379.855385][T20088] 
[ 2379.890211][T20164] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2379.913623][T20165] loop0: detected capacity change from 0 to 4096
[ 2379.928253][T20088] loop5: detected capacity change from 0 to 61
01:51:21 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x2000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:21 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x6000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:21 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x7a01, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2379.935288][T20088] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2379.935288][T20088] 
[ 2379.956079][T20165] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2380.013149][T20261] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:21 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f020000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:21 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xaa000000, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2380.073532][T20416] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2380.105880][T20439] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:21 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x400001}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:21 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x2500}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2380.125858][T20476] loop5: detected capacity change from 0 to 61
[ 2380.140845][T20477] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2380.154520][T20476] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2380.154520][T20476] 
01:51:22 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x6800}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2380.203791][T20476] loop5: detected capacity change from 0 to 61
[ 2380.212252][T20476] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2380.212252][T20476] 
01:51:22 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xa001, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2380.291348][T20622] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2380.327791][T20667] loop0: detected capacity change from 0 to 4096
01:51:22 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x1000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:22 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xeaffffff, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2380.360678][T20667] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2380.371475][T20787] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2380.388717][T20788] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:22 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x6c00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2380.402467][T20667] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2380.415065][T20789] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:22 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x2700}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:22 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f030000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2380.546810][T20993] loop5: detected capacity change from 0 to 80
[ 2380.566231][T20993] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2380.566231][T20993] 
[ 2380.567525][T21031] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:22 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xefffffff, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2380.602515][T20993] loop5: detected capacity change from 0 to 80
[ 2380.609540][T20993] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2380.609540][T20993] 
[ 2380.621712][T21098] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2380.636121][T21103] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:22 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x7400}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:22 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x1004000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:22 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xc103, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2380.655423][T21149] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:22 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x4800}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2380.710880][T21203] loop0: detected capacity change from 0 to 4096
[ 2380.739646][T21203] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2380.755745][T21203] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:22 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xf0ffffff, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:22 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f040000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2380.840284][T21509] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2380.859927][T21510] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2380.874547][T21511] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:22 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x7a00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:22 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x2000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2380.907880][T21601] loop5: detected capacity change from 0 to 96
[ 2380.931935][T21601] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2380.931935][T21601] 
[ 2380.932620][T21625] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2380.982785][T21601] loop5: detected capacity change from 0 to 96
[ 2380.990267][T21601] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2380.990267][T21601] 
01:51:22 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x4a03}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:22 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xf36c0000, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:22 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xedc0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:22 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xe803}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2381.070606][T21850] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2381.083363][T21852] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2381.109770][T21853] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:22 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x3000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2381.136479][T21869] loop0: detected capacity change from 0 to 4096
[ 2381.170701][T21869] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2381.183806][T21869] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2381.197476][T21965] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:23 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xfcffffff, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:23 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f050000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:23 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x4c00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2381.260007][T22255] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2381.272749][T22256] loop5: detected capacity change from 0 to 118
[ 2381.291933][T22256] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2381.291933][T22256] 
01:51:23 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x400001}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2381.314735][T22283] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2381.352730][T22284] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2381.366075][T22256] loop5: detected capacity change from 0 to 118
[ 2381.380800][T22256] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2381.380800][T22256] 
01:51:23 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x4000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:23 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xfc02, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2381.437172][T22388] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2381.460717][T22389] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:23 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x6000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:23 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xfeffffff, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:23 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x1000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2381.481665][T22457] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2381.543214][T22595] loop0: detected capacity change from 0 to 4096
[ 2381.562632][T22597] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2381.574242][T22599] loop5: detected capacity change from 0 to 126
[ 2381.596520][T22595] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2381.615521][T22599] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2381.615521][T22599] 
[ 2381.635459][T22595] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:23 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x5000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2381.672519][T22861] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2381.684618][T22599] loop5: detected capacity change from 0 to 126
[ 2381.696351][T22599] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2381.696351][T22599] 
01:51:23 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xffffff7f, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2381.724603][T22862] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2381.763481][T22957] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:23 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xfd00, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:23 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x6800}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2381.810761][T22968] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:23 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x1004000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:23 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f060000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:23 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x6000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:23 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xffffff80, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2381.949565][T23216] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2381.949748][T23218] loop5: detected capacity change from 0 to 126
[ 2381.994130][T23218] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2381.994130][T23218] 
[ 2382.031691][T23218] loop5: detected capacity change from 0 to 126
01:51:23 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x6c00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2382.040638][T23323] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2382.053957][T23218] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2382.053957][T23218] 
[ 2382.071378][T23326] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:23 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xfd02, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:23 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xffffff9e, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:23 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x2000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:23 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x7000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2382.097450][T23450] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2382.148037][T23527] loop0: detected capacity change from 0 to 4096
[ 2382.160487][T23527] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2382.174580][T23527] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2382.200990][T23539] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2382.231269][T23529] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1144: group 0, block bitmap and bg descriptor inconsistent: 32768 vs 25 free clusters
01:51:24 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f080000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:24 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xffffffea, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2382.257225][T23820] loop5: detected capacity change from 0 to 126
[ 2382.258900][T23821] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2382.282001][T23820] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2382.282001][T23820] 
[ 2382.320504][T23822] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2382.341696][T23843] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2382.353756][T23820] loop5: detected capacity change from 0 to 126
01:51:24 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x3000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:24 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x7400}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:24 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x8000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:24 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xfeff, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2382.364647][T23820] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2382.364647][T23820] 
[ 2382.484768][T23946] loop0: detected capacity change from 0 to 4096
[ 2382.497586][T23946] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2382.517019][T23946] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
01:51:24 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xffffffef, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2382.534961][T24032] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2382.563030][T24074] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:24 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f100000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:24 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x4000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2382.588814][T24041] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2382.588983][T24158] loop5: detected capacity change from 0 to 127
[ 2382.610817][T24073] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2382.625398][T24158] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2382.625398][T24158] 
01:51:24 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xfffffff0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:24 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x9000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2382.672815][T24158] loop5: detected capacity change from 0 to 127
[ 2382.700612][T24158] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2382.700612][T24158] 
01:51:24 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x7a00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:24 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xff0f, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:24 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x5000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2382.714365][T24464] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2382.736553][T24466] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2382.780726][T24467] loop0: detected capacity change from 0 to 4096
[ 2382.809610][T24472] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2382.821165][T24467] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2382.832995][T24467] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2382.849318][T24515] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:24 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xa000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:24 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xfffffffc, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:24 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f180000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:24 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xb400}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2382.907709][T24815] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2382.925030][T24855] loop5: detected capacity change from 0 to 127
[ 2382.943940][T24855] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2382.943940][T24855] 
01:51:24 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x6000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2382.964618][T24888] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2382.981167][T24855] loop5: detected capacity change from 0 to 127
[ 2382.997172][T24855] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2382.997172][T24855] 
01:51:24 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xfffe, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2383.111428][T24893] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2383.129207][T24913] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:24 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xb000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:24 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x400001}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:25 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0xfffffffe, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2383.156315][T25080] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2383.194444][T25202] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:25 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x7000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2383.226477][T25203] loop0: detected capacity change from 0 to 4096
[ 2383.244564][T25203] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2383.258133][T25206] loop5: detected capacity change from 0 to 127
[ 2383.266204][T25203] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2383.290518][T25206] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2383.290518][T25206] 
[ 2383.332943][T25304] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2383.350822][T25206] loop5: detected capacity change from 0 to 127
[ 2383.357684][T25313] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:25 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f260000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:25 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local={0xfe, 0x0}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2383.381652][T25206] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2383.381652][T25206] 
[ 2383.409852][T25422] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:25 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xc000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:25 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:25 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x1000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:25 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x8000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2383.470422][T25619] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2383.582741][T25631] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2383.595250][T25630] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2383.601202][T25626] loop0: detected capacity change from 0 to 4096
[ 2383.618752][T25746] loop5: detected capacity change from 0 to 512
01:51:25 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1=0xe0000002, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2383.634588][T25807] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2383.641189][T25626] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2383.662422][T25746] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2383.662422][T25746] 
01:51:25 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xd000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:25 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x1004000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:25 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x9000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2383.674993][T25933] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2383.676414][T25626] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[ 2383.714432][T25746] loop5: detected capacity change from 0 to 512
[ 2383.721810][T25746] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2383.721810][T25746] 
01:51:25 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f300000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:25 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:25 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1=0xe0000003, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2383.831515][T26135] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2383.858900][T26138] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2383.872082][T26141] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2383.885727][T26153] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:25 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0xe000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:25 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xa000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:25 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x2000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2383.931782][T26348] loop5: detected capacity change from 0 to 1024
[ 2383.952458][T26348] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2383.952458][T26348] 
[ 2383.975470][T26350] loop0: detected capacity change from 0 to 4096
[ 2383.996975][T26349] ==================================================================
[ 2384.005062][T26349] BUG: KCSAN: data-race in jbd2_journal_commit_transaction / jbd2_log_wait_commit
[ 2384.014260][T26349] 
[ 2384.016574][T26349] write to 0xffff8881028fbc68 of 4 bytes by task 344 on cpu 1:
[ 2384.024108][T26349]  jbd2_journal_commit_transaction+0x2ad5/0x3430
[ 2384.030432][T26349]  kjournald2+0x268/0x490
[ 2384.034754][T26349]  kthread+0x262/0x280
[ 2384.038815][T26349]  ret_from_fork+0x1f/0x30
[ 2384.043226][T26349] 
[ 2384.045539][T26349] read to 0xffff8881028fbc68 of 4 bytes by task 26349 on cpu 0:
[ 2384.053157][T26349]  jbd2_log_wait_commit+0x100/0x210
[ 2384.058356][T26349]  jbd2_journal_stop+0x517/0x660
[ 2384.063300][T26349]  __ext4_journal_stop+0x99/0x110
[ 2384.068323][T26349]  ext4_symlink+0x4db/0x700
[ 2384.072820][T26349]  vfs_symlink+0x23f/0x350
[ 2384.077228][T26349]  do_symlinkat+0x104/0x380
[ 2384.081723][T26349]  __x64_sys_symlink+0x52/0x60
[ 2384.086478][T26349]  do_syscall_64+0x44/0xa0
[ 2384.090893][T26349]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 2384.096163][T26354] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2384.096781][T26349] 
[ 2384.096785][T26349] value changed: 0x00002b2f -> 0x00002b30
[ 2384.096795][T26349] 
[ 2384.096798][T26349] Reported by Kernel Concurrency Sanitizer on:
[ 2384.124386][T26349] CPU: 0 PID: 26349 Comm: syz-executor.2 Not tainted 5.15.0-rc6-syzkaller #0
[ 2384.133139][T26349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 2384.143199][T26349] ==================================================================
[ 2384.151545][T26356] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2384.164232][T26350] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2384.178766][T26348] loop5: detected capacity change from 0 to 1024
01:51:26 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xb000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2384.191779][T26450] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:26 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f7b0000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2384.230722][T26449] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2384.243154][T26348] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2384.243154][T26348] 
[ 2384.269021][T26463] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:26 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1=0xe0000008, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:26 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80040, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:26 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x10000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:26 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x3000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:26 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xc000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2384.307675][T26762] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2384.449393][T26844] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2384.469996][T26871] loop5: detected capacity change from 0 to 1024
[ 2384.471033][T26873] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:26 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1=0xe0000019, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:26 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x4000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2384.497937][T26872] loop0: detected capacity change from 0 to 4096
[ 2384.505655][T26871] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2384.505655][T26871] 
[ 2384.536808][T27077] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:26 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x11000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2384.550032][T26872] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2384.561280][T27078] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:26 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xd000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:26 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f7e0000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2384.592516][T26871] loop5: detected capacity change from 0 to 1024
[ 2384.599233][T26871] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2384.599233][T26871] 
01:51:26 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xc0000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:26 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1=0xe0000300, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2384.711430][T27289] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2384.737105][T27291] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:26 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x5000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2384.759849][T27350] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2384.796831][T27484] loop5: detected capacity change from 0 to 1536
01:51:26 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x12000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:26 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0xe000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2384.811204][T27498] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2384.831660][T27500] loop0: detected capacity change from 0 to 4096
[ 2384.843120][T27484] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2384.843120][T27484] 
[ 2384.868721][T27500] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2384.902513][T27484] loop5: detected capacity change from 0 to 1536
01:51:26 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2384.926314][T27484] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2384.926314][T27484] 
[ 2384.936571][T27605] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2384.954273][T27606] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:26 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x400000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2384.997083][T27788] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:26 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655ffe0000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:26 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x6000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:26 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x2, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:26 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x20000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:26 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x10000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2385.090856][T28014] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2385.135201][T28016] loop5: detected capacity change from 0 to 8192
[ 2385.153457][T28016] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2385.153457][T28016] 
[ 2385.202244][T28016] loop5: detected capacity change from 0 to 8192
[ 2385.203331][T28020] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2385.220192][T28016] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2385.220192][T28016] 
01:51:27 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x7000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:27 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1000000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:27 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x3, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2385.257755][T28093] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2385.289519][T28228] loop0: detected capacity change from 0 to 4096
01:51:27 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x11000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:27 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x25000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2385.314455][T28229] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2385.328468][T28236] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2385.341479][T28228] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
01:51:27 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f040200000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

[ 2385.410901][T28433] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:27 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x8000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2385.476200][T28587] loop5: detected capacity change from 0 to 32768
[ 2385.507245][T28587] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2385.507245][T28587] 
01:51:27 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x4, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2385.519199][T28640] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2385.538218][T28641] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2385.552516][T28647] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2385.565296][T28587] loop5: detected capacity change from 0 to 32768
01:51:27 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x12000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:27 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x27000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2385.580736][T28587] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2385.580736][T28587] 
[ 2385.616406][T28745] loop0: detected capacity change from 0 to 4096
01:51:27 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2000000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2385.625402][T28747] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2385.675228][T28745] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2385.712701][T28947] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:27 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x9, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:27 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x9000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:27 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000300000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:27 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x16000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:27 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x48000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2385.763236][T28946] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2385.777606][T28978] loop5: detected capacity change from 0 to 65536
[ 2385.777915][T28980] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2385.802240][T28978] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2385.802240][T28978] 
01:51:27 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2010000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2385.851743][T28978] loop5: detected capacity change from 0 to 65536
[ 2385.859401][T28978] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2385.859401][T28978] 
01:51:27 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x30, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2385.934285][T29265] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:27 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xa000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2385.984567][T29361] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2386.001766][T29362] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:27 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x20000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2386.026198][T29383] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:27 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x4c000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2386.060452][T29387] loop0: detected capacity change from 0 to 4096
[ 2386.073840][T29387] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2386.087035][T29488] loop5: detected capacity change from 0 to 65664
[ 2386.106270][T29488] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2386.106270][T29488] 
[ 2386.154461][T29671] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2386.168167][T29488] loop5: detected capacity change from 0 to 65664
01:51:28 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f020400000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:28 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x300, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2386.197394][T29488] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2386.197394][T29488] 
[ 2386.210072][T29677] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2386.223964][T29696] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:28 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2030000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2386.239475][T29707] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:28 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xb000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:28 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x60000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:28 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x25000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:28 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x900, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2386.406460][T30002] loop0: detected capacity change from 0 to 4096
[ 2386.417120][T30002] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2386.430782][T30007] loop5: detected capacity change from 0 to 65920
[ 2386.443879][T30008] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2386.459840][T30007] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2386.459840][T30007] 
[ 2386.482197][T30009] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2386.495268][T30010] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2386.522826][T30007] loop5: detected capacity change from 0 to 65920
[ 2386.542938][T30221] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:28 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xc000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:28 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f060400000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:28 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x68000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:28 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x3000, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:28 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x27000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2386.580734][T30007] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2386.580734][T30007] 
01:51:28 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2040000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2386.729771][T30420] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2386.755895][T30562] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:28 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xd000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:28 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x6cf3, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2386.783405][T30624] loop5: detected capacity change from 0 to 66048
[ 2386.784907][T30626] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2386.804935][T30624] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2386.804935][T30624] 
[ 2386.807591][T30625] loop0: detected capacity change from 0 to 4096
[ 2386.830740][T30563] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2386.860745][T30625] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2386.872315][T30624] loop5: detected capacity change from 0 to 66048
01:51:28 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x40000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:28 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000500000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:28 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x6c000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:28 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x3000000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2386.890001][T30624] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2386.890001][T30624] 
01:51:28 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0xf36c, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2386.964177][T30931] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2387.029714][T31034] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:28 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0xe000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2387.071163][T31035] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2387.093172][T31041] loop5: detected capacity change from 0 to 98304
[ 2387.099660][T31038] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:28 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x48000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:28 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:28 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x74000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2387.120411][T31041] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2387.120411][T31041] 
[ 2387.153389][T31244] loop0: detected capacity change from 0 to 4096
[ 2387.163313][T31041] loop5: detected capacity change from 0 to 98304
01:51:29 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x3010000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

[ 2387.170208][T31041] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2387.170208][T31041] 
[ 2387.180486][T31244] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
01:51:29 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000600000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:29 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x10000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2387.229719][T31340] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2387.293734][T31451] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2387.327234][T31563] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:29 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x7a000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:29 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x4c000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:29 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

[ 2387.343135][T31590] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2387.408775][T31657] loop5: detected capacity change from 0 to 98432
[ 2387.426722][T31657] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2387.426722][T31657] 
[ 2387.440429][T31659] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2387.458898][T31660] loop0: detected capacity change from 0 to 4096
[ 2387.487272][T31657] loop5: detected capacity change from 0 to 98432
01:51:29 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x11000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2387.505938][T31660] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended
[ 2387.520162][T31657] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2387.520162][T31657] 
[ 2387.538287][T31766] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2387.568264][T31767] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
[ 2387.604309][T31934] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x4
01:51:29 executing program 5:
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000003001500dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2", 0x61, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f00000000c0)=ANY=[])

01:51:29 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in=@remote, @in6=@local}, {@in6=@private0}, @in=@multicast2}}, 0xf0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@local, @in=@multicast1, 0x0, 0x3, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0)

01:51:29 executing program 0:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
stat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f040600000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[])
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080))
syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd_index=0x9, 0x387, {0x0, r0}, 0x3, 0x5}, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r3=>0x0}, 0x0)
fchown(r1, 0xee01, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r5=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r5, 0x0)
lchown(&(0x7f00000001c0)='./file0/file0\x00', r5, r3)
fstat(r0, &(0x7f0000000300))
lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, 0xffffffffffffffff}, {0x2, 0x1, 0xee01}], {0x4, 0x1}, [{0x8, 0x5}, {}, {0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x6}, {}, {0x8, 0x7, r3}, {0x8, 0x1}], {0x10, 0x2}}, 0x74, 0x1)
rmdir(&(0x7f00000000c0)='./file0/file0\x00')
r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800004, 0x12, r6, 0x0)
openat(r6, 0x0, 0x401, 0x1)

01:51:29 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885fb026cdfe459f6eb573ff3184b849f10a5cd46caf67158d90c70da480586ae382d36aee87239033a04c10bae1272ce17124b9de6cb7b142f7151025d9f33923b55926fb024db58c682caadb6f5f374f84015c518341d54c9418592375cba52c9b591e79c5fd286c22844aced4c6874bb274cc6659664579"], 0x3}, 0x1, 0x0, 0x0, 0x20000014}, 0x40025)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000200)={0x0, 0x4, 0x9})
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x0, 0x8a030000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

01:51:29 executing program 4:
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}})
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x60000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2387.661176][T32035] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
01:51:29 executing program 3:
openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4c00}, 0x0, 0x12000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[ 2387.741346][T32173] loop5: detected capacity change from 0 to 131072
[ 2387.756820][T32173] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2387.756820][T32173] 
[ 2387.784824][T32176] ref_ctr_offset mismatch. inode: 0x46f offset: 0x4c00 ref_ctr_offset(old): 0xa ref_ctr_offset(new): 0x6
[ 2387.808699][T32173] loop5: detected capacity change from 0 to 131072
[ 2387.816922][T32173] EXT4-fs (loop5): invalid inodes per group: 1376259
[ 2387.816922][T32173] 
01:51:29 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0})
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5}, 0x0, 0x0, 0x0, 0x7, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, <r1=>0x0}})
dup(r0)
sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYRESOCT, @ANYRES32, @ANYRES64, @ANYBLOB="d101bb7f13f7a647d7064a7693fb9c172fa9371f58b125d4147dc1c8c5ea259127dcce46128ef93c208d7c023b356b73d89c7f919b3cf46c47130b271982b86d19f60014d0d79793f107c3d34895b0038aeff22129f49653706fdfbdc25621998d7d50fbd78defb524b9d8e97ad83d70c5cecb431f98468f79b4ae69bf48a4e324bfea44662b09b58f949c0f81f5f91915bc3a3c5551fe426efeb9f4a755858e9ea6ac0000003f00000000919d3c9ac3fae7a2e6b5b23034280ba87711cd5a091c9414b35722b71f640efea60418e994de389b3c2cbea3cc7652d7997c45af7e14f7790e23be514cacfa3856dc98ca9ecf5e454a6efeba6842e4d2e3cbb8821d60936b788c7c574099b55eb63f0a25423d818c32fbefae9628ab8246106b8e6d1a8a01d393ff02acbd93ad455556f6945686685941380c4a4e862e7d853123bbd3eba4b6450b2b4073ba51820807cab83ff8a0c6f1621a40bf20bee7dfdc7a07c455ef623e8ff580564c736eccfe660868a5537fd81263ac01199131c1df2250a02700b2753f8d32d0c30e4bf10989f5d1df916fc757a2000000000000000000000000000000cc655b5697546fb8153aded322c217c487a2f3c32146145dcd1d8e684c569e8fbcd024bc74591fcd63f4ec25817e6b94def9758d502b6e9ba9ff30885f