&(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0xc00, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:05 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x300) [ 2921.233415][T21562] FAULT_INJECTION: forcing a failure. [ 2921.233415][T21562] name failslab, interval 1, probability 0, space 0, times 0 [ 2921.246306][T21562] CPU: 0 PID: 21562 Comm: syz-executor.1 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2921.257169][T21562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2921.267452][T21562] Call Trace: [ 2921.270820][T21562] dump_stack+0x137/0x19d [ 2921.275361][T21562] should_fail+0x23c/0x250 [ 2921.279785][T21562] ? vm_area_dup+0x44/0x120 [ 2921.284903][T21562] __should_failslab+0x81/0x90 [ 2921.290542][T21562] should_failslab+0x5/0x20 [ 2921.295543][T21562] kmem_cache_alloc+0x46/0x2f0 [ 2921.301220][T21562] vm_area_dup+0x44/0x120 [ 2921.306694][T21562] __split_vma+0x82/0x320 [ 2921.311605][T21562] ? vmacache_find+0x313/0x320 [ 2921.316910][T21562] __do_munmap+0x2e9/0x1340 [ 2921.321591][T21562] ? strlcpy+0x65/0x80 [ 2921.325776][T21562] ? kernfs_path_from_node_locked+0x131/0x890 [ 2921.332079][T21562] mmap_region+0x58a/0x13e0 [ 2921.336871][T21562] ? security_mmap_addr+0x78/0x90 [ 2921.341892][T21562] do_mmap+0x77d/0xc90 [ 2921.345984][T21562] vm_mmap_pgoff+0xfc/0x1d0 [ 2921.350527][T21562] ksys_mmap_pgoff+0x2a8/0x380 [ 2921.355276][T21562] do_syscall_64+0x4a/0x90 [ 2921.359770][T21562] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2921.365822][T21562] RIP: 0033:0x466642 [ 2921.370495][T21562] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 2921.390908][T21562] RSP: 002b:00007f070ca2b0f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 2921.400077][T21562] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 0000000000466642 [ 2921.408927][T21562] RDX: 0000000000000003 RSI: 0000000000200000 RDI: 00000000206d6000 [ 2921.417251][T21562] RBP: 00000000206d6000 R08: 0000000000000004 R09: 0000000010000000 [ 2921.425941][T21562] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000000 [ 2921.434470][T21562] R13: 00000000206d6000 R14: 0000000020000180 R15: 00000000203b2000 [ 2921.963661][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2921.972150][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2922.010149][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.018467][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2922.030637][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.039652][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2922.182001][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.190431][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2922.206221][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.214757][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2922.227339][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.235741][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2922.254121][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.262520][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2922.285196][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.293410][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2922.305778][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.315375][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2922.367672][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.376027][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2922.389959][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.398331][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2922.411149][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.420926][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2922.442425][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.451731][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2922.468448][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.478011][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2922.491157][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.500703][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2922.515305][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.524323][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2922.539824][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.549763][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2922.563343][T21535] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2922.572236][T21535] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:06 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:06 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) io_uring_enter(r0, 0x1dfa, 0xe59d, 0x0, &(0x7f0000000040)={[0x7ff]}, 0x8) 23:56:06 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0xd00, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:06 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup3(r0, r1, 0x80000) r2 = socket$inet6(0xa, 0x800, 0xdc) mmap(&(0x7f000064d000/0x3000)=nil, 0x3000, 0x4, 0x50, r2, 0x47a02000) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff00}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:06 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:06 executing program 1 (fault-call:0 fault-nth:44): syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:06 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x0, 0x49}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2922.797036][T21587] FAULT_INJECTION: forcing a failure. [ 2922.797036][T21587] name failslab, interval 1, probability 0, space 0, times 0 [ 2922.810325][T21587] CPU: 0 PID: 21587 Comm: syz-executor.1 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2922.820884][T21587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2922.831282][T21587] Call Trace: [ 2922.834838][T21587] dump_stack+0x137/0x19d [ 2922.841702][T21587] should_fail+0x23c/0x250 [ 2922.847004][T21587] ? anon_vma_clone+0x8d/0x380 [ 2922.852267][T21587] __should_failslab+0x81/0x90 [ 2922.858202][T21587] should_failslab+0x5/0x20 [ 2922.863242][T21587] kmem_cache_alloc+0x46/0x2f0 [ 2922.869901][T21587] anon_vma_clone+0x8d/0x380 [ 2922.877962][T21587] __split_vma+0x134/0x320 [ 2922.882685][T21587] ? vmacache_find+0x313/0x320 [ 2922.888421][T21587] __do_munmap+0x2e9/0x1340 [ 2922.893241][T21587] ? strlcpy+0x65/0x80 [ 2922.897634][T21587] ? kernfs_path_from_node_locked+0x131/0x890 [ 2922.904259][T21587] mmap_region+0x58a/0x13e0 [ 2922.909071][T21587] ? security_mmap_addr+0x78/0x90 [ 2922.914407][T21587] do_mmap+0x77d/0xc90 [ 2922.918995][T21587] vm_mmap_pgoff+0xfc/0x1d0 [ 2922.923604][T21587] ksys_mmap_pgoff+0x2a8/0x380 [ 2922.928568][T21587] do_syscall_64+0x4a/0x90 [ 2922.933070][T21587] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2922.938983][T21587] RIP: 0033:0x466642 [ 2922.942883][T21587] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 2922.963179][T21587] RSP: 002b:00007f070ca2b0f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 2922.971781][T21587] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 0000000000466642 [ 2922.979845][T21587] RDX: 0000000000000003 RSI: 0000000000200000 RDI: 00000000206d6000 [ 2922.988788][T21587] RBP: 00000000206d6000 R08: 0000000000000004 R09: 0000000010000000 23:56:07 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r1, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) fcntl$getownex(r1, 0x10, &(0x7f00000000c0)) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$EVIOCSMASK(r2, 0x40104593, &(0x7f0000000080)={0x4, 0x1c, &(0x7f0000000040)="8ca00eaa61b921010678acf54f1415614b696066cd0a7df674b01e5a"}) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x1b0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb6a}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x9) 23:56:07 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0xe00, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:07 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0xf80b, 0x20}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f00006d7000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2922.997309][T21587] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000000 [ 2923.006687][T21587] R13: 00000000206d6000 R14: 0000000020000180 R15: 00000000203b2000 23:56:07 executing program 1 (fault-call:0 fault-nth:45): syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:07 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) io_uring_enter(r0, 0x2200, 0x7ac2, 0x1, &(0x7f0000000040)={[0x7]}, 0x8) syz_io_uring_setup(0x75cf, &(0x7f0000000100)={0x0, 0x0, 0x8}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00003b2000/0x4000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2923.268809][T21605] FAULT_INJECTION: forcing a failure. [ 2923.268809][T21605] name failslab, interval 1, probability 0, space 0, times 0 [ 2923.285666][T21605] CPU: 0 PID: 21605 Comm: syz-executor.1 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2923.297865][T21605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2923.310379][T21605] Call Trace: [ 2923.314284][T21605] dump_stack+0x137/0x19d [ 2923.318743][T21605] should_fail+0x23c/0x250 [ 2923.323167][T21605] ? vm_area_alloc+0x28/0xa0 [ 2923.328808][T21605] __should_failslab+0x81/0x90 [ 2923.334462][T21605] should_failslab+0x5/0x20 [ 2923.340273][T21605] kmem_cache_alloc+0x46/0x2f0 [ 2923.345420][T21605] vm_area_alloc+0x28/0xa0 [ 2923.350252][T21605] mmap_region+0x721/0x13e0 [ 2923.355383][T21605] ? security_mmap_addr+0x78/0x90 [ 2923.360670][T21605] do_mmap+0x77d/0xc90 [ 2923.364845][T21605] vm_mmap_pgoff+0xfc/0x1d0 [ 2923.370334][T21605] ksys_mmap_pgoff+0x2a8/0x380 [ 2923.376269][T21605] do_syscall_64+0x4a/0x90 [ 2923.380798][T21605] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2923.387069][T21605] RIP: 0033:0x466642 [ 2923.391167][T21605] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 2923.411710][T21605] RSP: 002b:00007f070ca2b0f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 2923.421120][T21605] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 0000000000466642 [ 2923.429743][T21605] RDX: 0000000000000003 RSI: 0000000000200000 RDI: 00000000206d6000 [ 2923.439732][T21605] RBP: 00000000206d6000 R08: 0000000000000004 R09: 0000000010000000 [ 2923.447904][T21605] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000000 [ 2923.455962][T21605] R13: 00000000206d6000 R14: 0000000020000180 R15: 00000000203b2000 [ 2923.988100][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2923.996475][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2924.034929][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.045766][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2924.059967][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.069775][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2924.213534][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.222264][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2924.237651][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.246124][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2924.258245][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.266474][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2924.286794][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.295408][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2924.317984][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.326813][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2924.340526][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.348863][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2924.396312][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.404427][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2924.419361][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.427978][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2924.440099][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.448226][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2924.472429][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.482040][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2924.496427][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.506657][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2924.520548][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.530404][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2924.542803][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.551700][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2924.566296][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.574963][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2924.587910][T21575] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2924.597660][T21575] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:08 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x1200, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:08 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:08 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/exe\x00', 0x0, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(r1, &(0x7f0000000500)='./file0\x00', 0x410000, 0x50) write(r0, &(0x7f0000000080)="54e972bbda9ff5ab93965baca75a81edb2744a4333da3d2c2ffc55d5c497415ee52e565a697855a41f9c098738a33867d85aa54160506432873a0affeea193464b7cf57d6309ae101bd57121a81731036fd7fd1eba685b6471fa429c6574a244763b283c40e9a155d916987d6f52c875212f9517b2d3f79e485d1bd4fc79f50aafc827b22b67e021e7a0f138f6ef6fabb57f47934e13e64e245c4165b0db97377e526de403a38dc397a9809f467970f8feb5dd88cf795f8609aa1615ca7da74ae6526c16b1fc9aedd0d2da7b27fe11fb59ecf8d17e429fb7622bb14279dacd5f50d4aa4851153f06ba03e1d5bef8c1b2f5", 0xf1) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) pwrite64(r0, &(0x7f0000000540)="5f6962234aa69306c7e15660835a4777a4364f94798239", 0x17, 0x81) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c01}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) preadv(r2, &(0x7f00000004c0)=[{&(0x7f0000000200)=""/206, 0xce}, {&(0x7f0000000300)=""/35, 0x23}, {&(0x7f0000000340)=""/223, 0xdf}, {&(0x7f0000000440)=""/99, 0x63}], 0x4, 0x4b32, 0x9) 23:56:08 executing program 1 (fault-call:0 fault-nth:46): syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:08 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:08 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) r0 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) setxattr$security_selinux(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), &(0x7f0000000500)='system_u:object_r:depmod_exec_t:s0\x00', 0x23, 0x3) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x40800}, 0x0) ioctl$FITRIM(r3, 0xc0185879, &(0x7f00000002c0)={0x7, 0x20800, 0x5}) r4 = signalfd4(r0, &(0x7f0000000540)={[0x40]}, 0x8, 0x80000) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000580)={{{@in=@private=0xa010101, @in6=@empty, 0x4e21, 0x6, 0x4e21, 0x4000, 0x2, 0x80, 0x80, 0x1d, 0x0, 0xee01}, {0x8, 0xfffffffffffffff7, 0x794000000000000, 0x4, 0xffffffff, 0x81, 0x80000001, 0x100}, {0x4, 0x10000, 0x6, 0x5}, 0xfff, 0x6e6bb4, 0x6ec4b5104e8dde13, 0x0, 0x6, 0x3}, {{@in6=@private2, 0x4d4, 0x32}, 0xa, @in=@dev={0xac, 0x14, 0x14, 0x1e}, 0x3500, 0x2, 0x3, 0x7f, 0x1, 0x6, 0xfffffff9}}, 0xe8) syz_io_uring_setup(0x12e8, &(0x7f0000000100)={0x0, 0x61d4, 0x0, 0x3, 0x9a}, &(0x7f00006fa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000001c0), &(0x7f0000000200)=0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000280)=@IORING_OP_STATX={0x15, 0x6, 0x0, 0xffffffffffffff9c, &(0x7f0000000380), &(0x7f0000000240)='\x00', 0x0, 0x100, 0x1}, 0x80000000) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r6, 0x0) preadv(r6, &(0x7f0000000280), 0x18, 0xd9f, 0x0) io_uring_enter(r6, 0x5bc6, 0x85e4, 0x2, &(0x7f0000000040)={[0x3ff]}, 0x8) 23:56:08 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) dup2(r0, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000040)={0xff81, 0x4, 0x2000, 0xfffe, 0x17, "e9eb2e0286dc3914"}) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 2924.769390][T21618] FAULT_INJECTION: forcing a failure. [ 2924.769390][T21618] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2924.784385][T21618] CPU: 0 PID: 21618 Comm: syz-executor.1 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2924.795179][T21618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2924.806384][T21618] Call Trace: [ 2924.810036][T21618] dump_stack+0x137/0x19d [ 2924.814748][T21618] should_fail+0x23c/0x250 23:56:09 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 2924.819463][T21618] __alloc_pages+0x102/0x320 [ 2924.824809][T21618] alloc_pages+0x21d/0x310 [ 2924.829512][T21618] pte_alloc_one+0x29/0xb0 [ 2924.834834][T21618] __pte_alloc+0x2f/0x210 [ 2924.841941][T21618] remap_pfn_range_notrack+0x5b7/0x770 [ 2924.848573][T21618] remap_pfn_range+0x87/0xe0 [ 2924.853706][T21618] io_uring_mmap+0x23b/0x260 [ 2924.858534][T21618] mmap_region+0xbb6/0x13e0 [ 2924.863226][T21618] do_mmap+0x77d/0xc90 23:56:09 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) clone3(&(0x7f00000003c0)={0x2000000, &(0x7f0000000100)=0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000200), {0x29}, &(0x7f0000000240)=""/86, 0x56, &(0x7f00000002c0)=""/183, &(0x7f0000000380)=[0xffffffffffffffff], 0x1, {r1}}, 0x58) preadv(r3, &(0x7f0000000040), 0x0, 0xd9f, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x4000}, 0xffffffffffffffff, 0x0, r2, 0x1) [ 2924.867495][T21618] vm_mmap_pgoff+0xfc/0x1d0 [ 2924.872150][T21618] ksys_mmap_pgoff+0x2a8/0x380 [ 2924.877265][T21618] do_syscall_64+0x4a/0x90 [ 2924.881695][T21618] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2924.887718][T21618] RIP: 0033:0x466642 [ 2924.891790][T21618] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 2924.914197][T21618] RSP: 002b:00007f070ca2b0f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 2924.923200][T21618] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 0000000000466642 [ 2924.931623][T21618] RDX: 0000000000000003 RSI: 0000000000200000 RDI: 00000000206d6000 [ 2924.941466][T21618] RBP: 00000000206d6000 R08: 0000000000000004 R09: 0000000010000000 [ 2924.950634][T21618] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000000 [ 2924.959305][T21618] R13: 00000000206d6000 R14: 0000000020000180 R15: 00000000203b2000 23:56:09 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$CHAR_RAW_SECTGET(r1, 0x1267, &(0x7f0000000080)) preadv(r0, &(0x7f0000000280), 0x0, 0x5, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r2, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) ioctl$BTRFS_IOC_LOGICAL_INO_V2(r2, 0xc038943b, &(0x7f00000000c0)={0x3, 0x8, '\x00', 0x1, &(0x7f0000000040)=[0x0]}) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:09 executing program 0: sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x300064acb35c7e0a, 0x70bd2b, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x2000) r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000500)={0x0, 0x1611}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x1818, &(0x7f0000000080)={0x0, 0xe326, 0x8, 0x3, 0x1b7, 0x0, r0}, &(0x7f00003b2000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f00000002c0)=0x0, &(0x7f0000000580)) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x5000)=nil, 0x5000, 0x0, 0x1010, 0xffffffffffffffff, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f00000005c0)=@IORING_OP_CLOSE={0x13, 0x3, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x1) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000240)={&(0x7f0000000380)={0x148, 0x0, 0x100, 0x70bd2b, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x134, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x484391b0}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x86}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x51b04a4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x64}]}, {0x4c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x271241a7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x32381bd6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x49d89606}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x53}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x521a6b10}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x195cc3d1}]}, {0x4}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xaa}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb4}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x79}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc7}]}, {0x44, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x29c19329}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4c7cf10f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x13}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3cf11397}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x99}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x207df3d5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x159321f8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x23d588f2}]}, {0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x607a23c8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1eb9dc69}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x196209ef}]}]}]}, 0x148}, 0x1, 0x0, 0x0, 0x4008080}, 0x4080) 23:56:09 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x2000, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:09 executing program 1 (fault-call:0 fault-nth:47): syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2926.083423][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.092340][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2926.136238][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.154004][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2926.166801][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.175492][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2926.320398][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.329836][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2926.346287][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.354806][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2926.366525][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.374927][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2926.394637][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.403705][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2926.427627][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.436349][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2926.449777][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.458388][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2926.507268][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.515655][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2926.530243][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.539192][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2926.551836][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.562783][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2926.585076][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.593536][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2926.606005][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.614364][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2926.627535][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.636818][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2926.649685][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.659150][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2926.673298][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.682952][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2926.696063][T21620] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2926.705660][T21620] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:10 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x3f00, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:10 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x10000010000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:10 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$incfs(r0, &(0x7f0000000100)='.pending_reads\x00', 0x81400, 0x100) syz_io_uring_setup(0x4ad2, &(0x7f0000000080)={0x0, 0x0, 0x10, 0x0, 0x800000, 0x0, r1}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:10 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:10 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0xa100, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x10b) flock(r2, 0x2) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r2) sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x40, r3, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x800}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffffffff}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2fb90d3b}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x24000004}, 0x20000040) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r3, 0x221, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x20}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x80000000}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffff9}]}, 0x30}, 0x1, 0x0, 0x0, 0xc014}, 0x4040001) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:10 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:11 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) r0 = syz_open_dev$vcsu(&(0x7f0000000040), 0x52, 0x28000) mmap$IORING_OFF_SQES(&(0x7f00006d6000/0x1000)=nil, 0x1000, 0x100000c, 0x10010, r0, 0x10000000) 23:56:11 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x4000, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:11 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:11 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x6300, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:11 executing program 0: clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000040)={0x5, 0xd5, 0xb8c, 0x100000001, 0xfffffffffffffff8, 0x7f, 0x6}, &(0x7f0000000100)={0x5, 0x3f, 0x1, 0x8000, 0x7d53847a, 0x0, 0x400, 0x10001}, &(0x7f0000000140)={0x7, 0x6, 0xfffffffffffff0c1, 0x8, 0x0, 0x17, 0x3, 0x7}, &(0x7f0000000200)={r0, r1+10000000}, &(0x7f0000000280)={&(0x7f0000000240)={[0x3]}, 0x8}) r2 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r3 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = pidfd_getfd(0xffffffffffffffff, r3, 0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r7, 0x0, 0x0, 0x0, 0x34}, 0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r6, 0x0, 0x0, 0x0, 0x40800}, 0x0) r8 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r8, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) write$binfmt_aout(r8, &(0x7f0000000500)=ANY=[@ANYBLOB="830006053802000021020000ff7f00003b03000066a900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000edff00"/1056], 0x420) syz_io_uring_setup(0x2962, &(0x7f0000000380)={0x0, 0x2401, 0x0, 0x1, 0x50, 0x0, r2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00003b2000/0x2000)=nil, &(0x7f00000002c0), &(0x7f0000000400)=0x0) syz_io_uring_submit(r4, r9, &(0x7f00000004c0)=@IORING_OP_OPENAT2={0x1c, 0x5, 0x0, 0xffffffffffffff9c, &(0x7f0000000440)={0x40001, 0x200, 0xa}, &(0x7f0000000480)='./file0\x00', 0x18, 0x0, 0x23456}, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:11 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x2}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2927.841852][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2927.852115][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2927.894235][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2927.903851][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2927.917683][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2927.927067][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2928.067301][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.078859][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2928.095751][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.104965][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2928.118783][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.129745][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2928.150798][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.159424][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2928.183591][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.193628][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2928.207439][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.216757][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2928.265116][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.274313][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2928.288890][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.298582][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2928.311009][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.319471][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2928.341127][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.350181][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2928.362778][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.371596][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2928.384649][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.393309][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2928.405712][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.413904][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2928.426369][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.434856][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2928.448382][T21664] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2928.456517][T21664] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:12 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x40000100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:12 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x4}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:12 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x8102, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:12 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:12 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req={0x7fff, 0x5, 0x401, 0x6c}, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:12 executing program 0: syz_io_uring_setup(0x4e83, &(0x7f0000000080)={0x0, 0x138c, 0x2}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000000, 0x2010, 0xffffffffffffffff, 0x10000000) r0 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000007, 0x80010, r0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000400)={r0, 0x0, 0xaa5, 0x1}) syz_io_uring_submit(r1, r2, &(0x7f0000000580)=@IORING_OP_STATX={0x15, 0x5, 0x0, r4, &(0x7f0000000440), &(0x7f0000000540)='./file0\x00', 0x200, 0x2400}, 0x0) syz_io_uring_setup(0x64b0, &(0x7f0000000200)={0x0, 0xdea9, 0x2, 0x2, 0x206, 0x0, r0}, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000280), &(0x7f00000002c0)=0x0) syz_io_uring_submit(r3, r5, &(0x7f00000003c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000380)='./file0\x00', 0x12, 0x200840, 0x12345}, 0x7) syz_io_uring_setup(0x1958, &(0x7f0000000100)={0x0, 0x1fc2, 0x20, 0x1, 0x3b8}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000000040), &(0x7f00000001c0)) 23:56:12 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x8, 0xffffffffffffffff, 0x1) 23:56:12 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x7}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:12 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x369}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:12 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x8200, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:12 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r1 = syz_open_dev$ptys(0xc, 0x3, 0x0) ftruncate(r1, 0x3) 23:56:12 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000000, 0x110, r0, 0x10000000) syz_io_uring_submit(0x0, r1, &(0x7f0000000040)=@IORING_OP_WRITE={0x17, 0x4, 0x4007, @fd_index=0x2, 0x6, &(0x7f00000001c0)="9f78410f08ca04a7ace81608a21b7ef0a5adb5d8945dd4678fed3dcb1665fdc20df6ad99e622eeafb8d842a1ddceda0f823ca556e5cd8f18ed67d7f40a9c6e69164b6873411cd16f55b2aa83540e9887821946fdfa29078198ae6844d3ba233da446ea71cc08a129139b34c06871b932d43b76fa1409cf7c45d972c2300af1a50c5e30088773999f0374e820cfca3b80174d835a8df878fbccc5c29c257ed7a1253eec8a0e0da74e915746a80a40c7e9f0345c52b994b51f4045d99874b8336daaa3c2d138a10bd5cfd920ab738233f0c4f8f2b64c47e7b118f791479b117df21b", 0xe1, 0x3fe754bfccf0c771, 0x1}, 0x100) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:13 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x8}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2929.580727][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2929.589287][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2929.631355][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2929.641105][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2929.654890][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2929.663258][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2929.803883][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2929.813142][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2929.828252][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2929.839379][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2929.851667][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2929.866079][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2929.886120][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2929.895114][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2929.919664][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2929.929462][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2929.943575][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2929.952578][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2930.001255][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2930.010260][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2930.026523][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2930.035113][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2930.049350][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2930.057877][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2930.080205][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2930.088720][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2930.102369][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2930.111688][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2930.124180][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2930.136689][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2930.149518][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2930.158364][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2930.173740][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2930.182044][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2930.194776][T21704] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2930.203313][T21704] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:14 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:14 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x9}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:14 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x3}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d7000/0x1000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:14 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0xe803, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:14 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:14 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) getsockname$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000080)=0x1c) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:14 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000100)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000040), 0x0, 0x4) 23:56:14 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x40010, r0, 0xb899c000) preadv(r0, &(0x7f0000000280), 0x63, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x6c00}, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffe}, 0xffffffffffffffff, 0xe, 0xffffffffffffffff, 0x1) r1 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r1, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) mmap(&(0x7f000075d000/0x4000)=nil, 0x4000, 0x300000f, 0x30, r1, 0x5dc92000) 23:56:14 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0xefff, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:14 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xfffffffd}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x4, 0x0, 0x1c5}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r6, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000040)=@IORING_OP_WRITE={0x17, 0x3, 0x4004, @fd=r0, 0x2, &(0x7f00000001c0)="67c08709f4a46e86294c21c18492e570a8e4e13639266402ff095605bdf2be92496ad4f62f1fec69923fe70b97754e5523e45c4a79ff5cea9bc19a318b00e5120fefacf7a9cb70378c7dbe424792a6b9947e640cc8880b8c7868e6846f12be74f2e1f24250100a2f3cf4adddb701a68ac5f01f7849516da5d2fc8438784c2e8d0f422aa3d20f656a79fa73695d36ebd3d952d7ea4606241916425717204feb996e28e5d6239bb50110ab202fbd33f91c", 0xb0, 0x0, 0x1}, 0x839) 23:56:14 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xa}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:14 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000000c0)=""/21, 0x15}, {&(0x7f0000000100)=""/70, 0x46}, {&(0x7f0000000200)=""/66, 0x42}, {&(0x7f0000000280)=""/15, 0xf}], 0x4, 0x1, 0x9) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) getdents(r0, &(0x7f0000000040)=""/74, 0x4a) [ 2931.236719][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.245146][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2931.284239][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.292493][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2931.304935][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.314707][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2931.459832][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.468943][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2931.483866][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.491887][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2931.504441][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.512811][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2931.532072][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.540706][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2931.562428][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.571084][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2931.591163][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.600020][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2931.648298][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.658085][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2931.672732][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.681395][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2931.693256][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.702488][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2931.724068][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.733223][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2931.745246][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.753631][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2931.765626][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.775982][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2931.791097][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.799976][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2931.814627][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.824697][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2931.841062][T21746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2931.850318][T21746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:16 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:16 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xf}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:16 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x40800}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000495000/0x2000)=nil, 0x2000, 0x3000000, 0x20010, r0, 0x10000000) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r5, 0x0) preadv(r5, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000040)=@IORING_OP_WRITE_FIXED={0x5, 0x2, 0x4004, @fd=r5, 0x9db, 0x0, 0xbf1, 0x6, 0x1, {0x1}}, 0xffff) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:16 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0xf600, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:16 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8cffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:16 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) r0 = open(&(0x7f0000000040)='./file0\x00', 0x48800, 0x84) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000100)=""/93, 0x5d}, {&(0x7f00000001c0)}, {&(0x7f0000000200)=""/118, 0x76}, {&(0x7f0000000280)=""/46, 0x2e}, {&(0x7f00000002c0)=""/49, 0x31}], 0x5) 23:56:16 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r0, r1, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_complete(r0) 23:56:16 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x21}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:16 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x1, 0x1, 0x8, 0x0, 0x0, 0x5, 0x80020, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, @perf_config_ext={0x8, 0x1}, 0xa00, 0x0, 0x9, 0x5, 0x101, 0x10000, 0x4c6, 0x0, 0x9, 0x0, 0xb66}, 0x0, 0x3, r1, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:16 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0xfe00, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:16 executing program 0: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00006d6000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) r0 = syz_io_uring_setup(0x65b7, &(0x7f0000000040)={0x0, 0xf0d8, 0x0, 0x3, 0x1ae}, &(0x7f00006d6000/0x1000)=nil, &(0x7f00006d7000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) syz_io_uring_setup(0x5b44, &(0x7f00000001c0)={0x0, 0xe7b5, 0x4, 0x3, 0x18d, 0x0, r0}, &(0x7f00006d6000/0x7000)=nil, &(0x7f00006da000/0x2000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000240)) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x40800}, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/asound/seq/clients\x00', 0x0, 0x0) syz_io_uring_submit(r1, r3, &(0x7f00000003c0)=@IORING_OP_OPENAT2={0x1c, 0x5, 0x0, r5, &(0x7f00000002c0)={0xc0000, 0x5, 0x3}, &(0x7f0000000380)='./file0\x00', 0x18, 0x0, 0x23456}, 0x36) 23:56:16 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000001, 0x2896212c7fb4f753, r0, 0x0) r2 = mmap$IORING_OFF_SQES(&(0x7f00006d5000/0x3000)=nil, 0x3000, 0x2000004, 0x8010, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x5}, 0x5) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2932.624596][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.633508][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2932.650457][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.659813][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2932.671965][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.680259][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2932.721284][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.730377][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2932.743683][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.752792][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2932.765407][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.774835][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2932.788599][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.796923][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2932.810953][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.821015][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2932.833625][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.844163][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2932.896657][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.906053][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2932.919363][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.927962][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2932.940132][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.949204][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2932.967085][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.975499][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2932.988431][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2932.996843][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2933.009178][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2933.018050][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2933.030734][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2933.040108][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2933.052983][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2933.061549][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2933.074810][T21786] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2933.084154][T21786] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:17 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0xff00, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:17 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:17 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000040)=""/2, 0x2}], 0x1, 0xd9f, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x8e8, 0x1) splice(r0, &(0x7f00000000c0)=0x4, r1, &(0x7f0000000140)=0xfffffffffffffffa, 0x44fb, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0x0, 0x0, 0x4, 0x0, 0x8, 0x0, 0x208, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0xff, 0x1}, 0x1102, 0x0, 0x2000000, 0x0, 0x0, 0xfffffffd, 0x100}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r3 = dup3(r2, r2, 0x80000) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000200)=""/185, 0xb9}, {&(0x7f00000002c0)=""/187, 0xbb}, {&(0x7f0000000380)=""/53, 0x35}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/66, 0x42}, {&(0x7f0000001440)=""/232, 0xe8}, {&(0x7f0000001540)=""/111, 0x6f}], 0x7, 0x1, 0x1) 23:56:17 executing program 0: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x34, r0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1000}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x8}, 0x20000000) syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:17 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x42}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:17 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xce020000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:17 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x8a}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:17 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0xff01, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:17 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x238400, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) ftruncate(r0, 0x6) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r1 = openat2(r0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x200000, 0x28, 0x11}, 0x18) sendmsg$NFNL_MSG_ACCT_GET(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, 0x1, 0x7, 0x801, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x8}, @NFACCT_NAME={0x9, 0x1, 'syz1\x00'}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0xcf}]}, 0x40}}, 0x0) 23:56:17 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0xff07, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:17 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)=0x0) syz_io_uring_setup(0x425f, &(0x7f0000000380)={0x0, 0x49c2, 0x20, 0x0, 0x1bc, 0x0, r0}, &(0x7f00006d7000/0x4000)=nil, &(0x7f00006d9000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f00000001c0)) syz_io_uring_submit(r2, r1, &(0x7f0000000280)=@IORING_OP_READ=@pass_buffer={0x16, 0x5, 0x4007, @fd, 0x517, &(0x7f0000000200)=""/95, 0x5f}, 0x20) 23:56:17 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000040)='./file1\x00', &(0x7f0000000080), &(0x7f00000000c0), 0x2, 0x3) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x44080, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 2934.287011][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.295477][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2934.337000][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.345334][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2934.357796][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.366365][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2934.505246][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.513491][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2934.528859][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.536893][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2934.549067][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.557481][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2934.577992][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.586872][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2934.609117][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.617675][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2934.630969][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.639626][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2934.695052][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.703384][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2934.717525][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.726353][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2934.738925][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.747445][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2934.769524][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.777782][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2934.790105][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.799533][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2934.812529][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.822935][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2934.837275][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.845760][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2934.858284][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.866399][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2934.878545][T21822] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2934.887039][T21822] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:19 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:19 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000002, 0x1010, r1, 0x6a15000) 23:56:19 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xf0}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:19 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0xff0f, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:19 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r0 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)=0x0) r2 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0x40800}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000057c0)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000380)=""/219, 0xdb}, {&(0x7f0000000480)=""/181, 0xb5}, {&(0x7f0000000040)=""/52, 0x34}, {&(0x7f0000000100)=""/127, 0x7f}, {&(0x7f0000000280)=""/91, 0x5b}], 0x6, &(0x7f00000005c0)=""/31, 0x1f}, 0x1ff}, {{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000600)=""/221, 0xdd}, {&(0x7f0000000700)=""/30, 0x1e}, {&(0x7f0000000740)=""/4096, 0x1000}], 0x3, &(0x7f0000001780)=""/113, 0x71}, 0x9}, {{&(0x7f0000001800)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f0000001900)=[{&(0x7f0000001880)=""/116, 0x74}], 0x1}, 0x2}, {{&(0x7f0000001940)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f0000002bc0)=[{&(0x7f00000019c0)=""/251, 0xfb}, {&(0x7f0000001ac0)=""/32, 0x20}, {&(0x7f0000001b00)=""/156, 0x9c}, {&(0x7f0000001bc0)=""/4096, 0x1000}], 0x4, &(0x7f0000002c00)=""/236, 0xec}, 0xff}, {{&(0x7f0000002d00)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000004140)=[{&(0x7f0000002d80)=""/92, 0x5c}, {&(0x7f0000002e00)=""/25, 0x19}, {&(0x7f0000002e40)=""/133, 0x85}, {&(0x7f0000002f00)=""/78, 0x4e}, {&(0x7f0000002f80)=""/160, 0xa0}, {&(0x7f0000003040)=""/61, 0x3d}, {&(0x7f0000003080)=""/192, 0xc0}, {&(0x7f0000003140)=""/4096, 0x1000}], 0x8, &(0x7f00000041c0)=""/4, 0x4}, 0x421}, {{&(0x7f0000004200)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f00000042c0)=[{&(0x7f0000004280)=""/5, 0x5}], 0x1, &(0x7f0000004300)=""/20, 0x14}, 0x37c1eca4}, {{0x0, 0x0, &(0x7f0000005700)=[{&(0x7f0000004340)=""/39, 0x27}, {&(0x7f0000004380)=""/18, 0x12}, {&(0x7f00000043c0)=""/233, 0xe9}, {&(0x7f00000044c0)=""/66, 0x42}, {&(0x7f0000004540)=""/4096, 0x1000}, {&(0x7f0000005540)=""/168, 0xa8}, {&(0x7f0000005600)=""/20, 0x14}, {&(0x7f0000005640)=""/132, 0x84}], 0x8, &(0x7f0000005780)}, 0x1}], 0x7, 0x40000000, &(0x7f0000005980)={0x0, 0x3938700}) syz_io_uring_submit(r3, r1, &(0x7f0000005a00)=@IORING_OP_ACCEPT={0xd, 0x4, 0x0, r6, &(0x7f00000059c0), 0x0, 0x0, 0x80800, 0x1}, 0x1000) r7 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r8, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r7, &(0x7f0000000000), 0x10000}]) r9 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000005ac0)='devices.allow\x00', 0x2, 0x0) r10 = dup2(r2, r5) r11 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r11, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) r12 = dup2(r6, r2) r13 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r13, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) r14 = openat(0xffffffffffffffff, &(0x7f0000005e00)='./file0\x00', 0x240080, 0x2e4) io_submit(r8, 0x5, &(0x7f0000005e80)=[&(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x6, 0xffffffffffffffff, &(0x7f0000005a40)="324e50b697b3737ac6fab67d54f89d63fc5e52e0fbc4f1a1dcfb9fe1c81345e08b381bfb37891d9f112aa950e45fab69b936f07af74c82301985174fe9b5c6fe32b53304d0c1e54e549d874278917f5b92c9d470d0d7f79fc8204649", 0x5c, 0x7, 0x0, 0x3}, &(0x7f0000005b40)={0x0, 0x0, 0x0, 0x8, 0x2, r9, &(0x7f0000005b00)="03ec802c270da5ac4bec804eca57ed9999257da4a512523e72b1f8929f47e96440f6c92585234e8a89abd7dc24", 0x2d, 0xe6bb, 0x0, 0x1, r10}, &(0x7f0000005c00)={0x0, 0x0, 0x0, 0x3, 0x4, r11, &(0x7f0000005b80)="4e7660442812a0376de8fd2376acb2c54ecc13388ba5972cd9f796086a1df387aa3ce2ad8b2db17f0418d309c2762c17e5715c124374fcda95333dadd936fd37e2ff9e460cf081779afc85dae32a868bebe2f7e2a3c43c5a73a07310e266a8ed9f5bb66167e6d13113d7457a462295f455c56d968fe8479320bd", 0x7a, 0x4, 0x0, 0x1, r12}, &(0x7f0000005d00)={0x0, 0x0, 0x0, 0x6, 0x5, r13, &(0x7f0000005c40)="bc665a1f7e049cf07c4dc79325b99a790361b271ab44aa334e3124c4c2e9e03de77a4f8406d6c5bb98c01e9b2ec88e9b0abe8814e422b49d5e86aa86f674a9e2a640d7210e67760f613cfca63346bc6dbcfbe43c259618a0db259e3cd973f143dacf9bfc4587593b1dfa00b7b76e022b4a4cc52fcdd88d20c9d902cc65a8dce6d455", 0x82, 0x7, 0x0, 0x2}, &(0x7f0000005e40)={0x0, 0x0, 0x0, 0x6, 0x4, r0, &(0x7f0000005d40)="ebdd1fd72bd971077a46a8edaec17120819477331fe81858bb36a99c3e3dc54af53383f7d2d4218002d36a8fd7341d7ff235da3961674d68b9162facba856a35ba844256b8d5348492450e09990f3198170cffded268596db26cac6c194d348965f8c71e523e838a34090263838bd4fa1afec8f5ce432441acc40eafb8920f75bf526e4f4a", 0x85, 0x3, 0x0, 0x0, r14}]) 23:56:19 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xe2030000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:19 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) io_uring_enter(r0, 0x62eb, 0x67d5, 0x2, &(0x7f0000000040), 0x8) 23:56:19 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r1, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) ioctl$INCFS_IOC_CREATE_FILE(r1, 0xc058671e, &(0x7f00000000c0)={{}, {0x101}, 0x5b3aa0e1ced2f0fd, 0x0, 0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)="ce28c7cfc7adb777138afe2ae1095accd3143705c7f40d69877ed2b31ff791f759419cd1b3757b341653eb9039148a7e32d2140224021756a49f7feacbea68bd2305e75fe595fc047e1fc743941ac3abfb6b6aef52690f75634d8aee5e5258c0ccac9a8a53a4da9ab1634e3da5efacf4d0b41e5a04bf6399ac320362d40b154c3ea28d01bea737c1ceb018752d4f6d1f1f8219af3de1367b4b4dd5557dafcf5401601cef006c15f6033884e5ec10a72cc990d11e8a5627b97269cb7bae7105a3972816844f2bd13a718c41c4ec250f1f83d5a840062760a78d673e2273c09ce4cbb942545b35da23844df789cef3d43c830d8ebfca4e4cdfca7b8e2136bf2dbfc31cce7e67dfafb0a691b01df91072f8d38d5327d05fa52bc35650585f4aca21e7d462c3eeeee08074fe90c0d93f5365db51b929a961fc2d4f4e48541b17dddf1ab3b21be3d29bf27939aaa019abd9bc4dba0bccf6db04c8c81024f3901b2c7d9a74b06c09ceb29e9bb2ec1ae0b81c0c2d69743254f7394976f789988997e2d6df1f03b2d55a8576ab495b16ee9c60aaeff8f2372cf46ef2a8626bf0a63026387f5bbaf92536e03bfb5dfb5a0153f4a0cfe7f63df4de0e0985367ddf4440468d6c77dd248fcc3ff81ae99a2eff8935ff5a8ea819263b131970", 0x1d9, 0x0, &(0x7f0000000400)={0x2, 0x131, {0x1, 0xc, 0xd9, "c42830f3d2b42b835e3d5fcd44baa4b5d5455fc8cf301096aa4d0519c0e0922d902dd4d6dba137a6dca3e95a158e1131d207a8a60a201f09b102f2a758148f6fe460236c0e3e83d15517b127304cea93080a2b98d0cde6ad37347fd70b460c52e3be9fd3f49cbd54244578db32d706072017db949d01d7673f25eacd1e78dba8e5148ad37aae531752c63a05fcebe70091d27a78611637391c6e650b1271b0754eca3b27a7d02b509c6187c3ac131614a8f42228b5ecb12a162a332600575983afd757d8cc29f9ec1270a6ff0b69db22a3e94b0c6335ac4489", 0x4b, "5aac5913c04c69714ae2cf78c06dd37323cff03416428ad2e1e4f265ec2a1d4b6e3915d673a2e89066c15dfce2ca8964fb72b31b5f5cddd86dd5083077d13393dc7d140fa515f2356035e5"}, 0x13, "ce2f32f229670c5bbd614c5f2d035baa10a81e"}, 0x150}) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:19 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xfe}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:19 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0xffef, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:19 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000040)=0x80000001, 0x0, 0x4) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r0, r1, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0xc, &(0x7f0000000100), 0x0, 0x4) 23:56:19 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) sendmsg$DEVLINK_CMD_PORT_SET(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0xa0, 0x0, 0x300, 0x70bd26, 0x25dfdbfb, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x6, 0x4, 0x2}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x6, 0x4, 0x3}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x6, 0x4, 0x1}}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000}, 0x400c800) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 2935.791873][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2935.800180][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2935.817794][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2935.826759][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2935.841054][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2935.849786][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2935.883590][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2935.892088][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2935.905047][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2935.913465][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2935.926059][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2935.934781][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2935.949004][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2935.957652][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2935.971324][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2935.979616][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2935.991938][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2936.000534][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2936.043534][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2936.052012][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2936.065477][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2936.074325][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2936.087555][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2936.096453][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2936.113506][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2936.122372][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2936.134925][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2936.143314][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2936.155264][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2936.164311][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2936.177149][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2936.185807][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2936.197956][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2936.206378][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2936.218802][T21869] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2936.226982][T21869] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:20 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0xffff, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:20 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:20 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = signalfd4(r0, &(0x7f0000000040)={[0x5]}, 0x8, 0x800) syz_io_uring_setup(0x7ac8, &(0x7f0000000100)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, r1}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:20 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800007, 0x4010, r0, 0x2000) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$inet(r1, &(0x7f0000002540)={&(0x7f0000002140)={0x2, 0x4e24, @empty}, 0x10, &(0x7f0000002400)=[{&(0x7f0000002180)="9ecdb0e3d994bd2b0772e5cdad7750b751a67bad01cd093f99012417c4ca4f805db3c42988826d59f7595a33c69f6a3d3a372d260b2b8bc4db87ef5f8aa7ea1c8de4021a94d0018610e5b8bb9f809af047f7662db47b308b071a06dde104173fdd621446174be5d88c90a600a156b1029b20ee47a4da281c86677fbffffb", 0x7e}, {&(0x7f0000002200)="f06ed9b376fb916564500a6298d3957a5d5c9cca5aff1c9a8637e63f095a571d6cde5282009dc242d20b1918131cde7f05a8c3bcd2df530a51629e0bbd38bfad534791f0a6c8268c4cea82c4549cead36b0d86995ba85da9e534ec46c7a45a0117cdbed9ddcdce42de24f90c033e9a1293c67c225921e88a27d4f0da7e4d05fd251483e3fb10e19a8a17b6dd14dd", 0x8e}, {&(0x7f00000022c0)="2a1d297cc71e5627705dadf4748d32", 0xf}, {&(0x7f0000002300)="13f7e1d5b0efe7a5586de3017e670629c0717ccada3ecb8d541cf9bc63ae9d8ef279c02ec6f3ca0cc9e9e690c9f6290b25741d10e1c19891d98fa12407bee203a553926be5481a644557f72d6aed1920c8b95ed9a132136e11d82514db72e7c40533de29fa1224bab69cddf18668ee0d72cf58c9e8ecdca6a73f37888cda6e2be0e809c980", 0x85}, {&(0x7f00000023c0)="b925eadcf59a1314a34f0c699247431fc91d1efd3eab771a81b6b08f", 0x1c}], 0x5, &(0x7f0000002480)=[@ip_retopts={{0x3c, 0x0, 0x7, {[@timestamp_addr={0x44, 0xc, 0x1e, 0x1, 0x3, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x10000}]}, @timestamp_addr={0x44, 0xc, 0xdf, 0x1, 0xd, [{@local, 0x1ff}]}, @timestamp={0x44, 0x14, 0x5e, 0x0, 0x4, [0x63d, 0x7, 0xffff, 0x7ff]}]}}}, @ip_retopts={{0x38, 0x0, 0x7, {[@noop, @end, @timestamp={0x44, 0x24, 0xab, 0x0, 0xb, [0x100, 0x3, 0x4, 0x7, 0x800, 0x1, 0x4, 0xfffffffc]}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xbfb}}, @ip_retopts={{0x18, 0x0, 0x7, {[@timestamp_prespec={0x44, 0x4, 0xae, 0x3, 0xb}, @end]}}}], 0xa8}, 0x8000) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) mmap(&(0x7f00005d6000/0x3000)=nil, 0x3000, 0x2000018, 0x40e5070, r0, 0xbb6a6000) openat2(r0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x20402, 0x0, 0x2}, 0x18) 23:56:20 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xec030000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:20 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x204}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:20 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x2}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000040), &(0x7f0000000000)) 23:56:20 executing program 2: ioctl$BTRFS_IOC_LOGICAL_INO(0xffffffffffffffff, 0xc0389424, &(0x7f0000000080)={0xd184, 0x20, '\x00', 0x1, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0]}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r2 = gettid() r3 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r3, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) lseek(r3, 0x8, 0x1) perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0x1, 0x1, 0x0, 0x5, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x2, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_bp={&(0x7f00000000c0), 0xa}, 0x58000, 0x400, 0xffffb538, 0x4, 0x2313, 0x800, 0x4, 0x0, 0x5, 0x0, 0x3}, r2, 0x9, r1, 0x1) 23:56:20 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x8200}]) 23:56:20 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x374}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:20 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) io_uring_enter(r0, 0x965, 0xfb96, 0x0, &(0x7f0000000040)={[0xb1]}, 0x8) 23:56:20 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000040)={@private=0xa010100, @loopback, 0x0, 0x8, [@broadcast, @rand_addr=0x64010101, @remote, @local, @multicast2, @remote, @multicast1, @empty]}, 0x30) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:20 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0xa000}]) [ 2937.387311][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.395764][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2937.436447][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.444706][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2937.456535][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.464885][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2937.605351][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.614094][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2937.629557][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.637588][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2937.650311][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.658568][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2937.678221][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.686343][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2937.708409][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.717043][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2937.729421][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.737863][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2937.792825][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.801083][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2937.815140][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.823583][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2937.837548][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.846723][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2937.868619][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.878611][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2937.890880][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.899219][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2937.911131][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.919764][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2937.933036][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.942849][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2937.956212][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.965117][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2937.981299][T21910] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2937.990164][T21910] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:22 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:22 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x402}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:22 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x800000}]) 23:56:22 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r1, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) sendfile(r1, r0, &(0x7f0000000040)=0x7, 0x8) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:22 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xf6ffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:22 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x50, r0, 0x10000000) pipe(&(0x7f0000000040)={0xffffffffffffffff}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r4 = syz_io_uring_setup(0xd9d, &(0x7f0000000100), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f0000000180)) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r5 = socket$inet6(0xa, 0x1, 0x0) r6 = socket$inet(0x2, 0x3, 0x5) setsockopt$inet_msfilter(r6, 0x0, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB='y'], 0x1) getsockopt$inet_pktinfo(r6, 0x0, 0x8, &(0x7f0000000040)={0x0, @local, @local}, &(0x7f0000000140)=0xc) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000040)={@rand_addr=' \x01\x00', r7}, 0x14) connect$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x2, r7, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r8 = syz_io_uring_setup(0x21cb, &(0x7f0000000000), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f0000000100)) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r4, 0x6, 0x400000, r9) syz_io_uring_submit(0x0, r1, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@add={0x1d, 0x5, 0x0, r2, &(0x7f0000000100)={0x1001}, r3, 0x1, 0x0, 0x1, {0x0, r9}}, 0xffff3afc) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:22 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3a, 0x401}, 0x10800, 0x2}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:22 executing program 0: finit_module(0xffffffffffffffff, &(0x7f0000000040)='\\-\\{\x00', 0x2) syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000680)='cpuacct.stat\x00', 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000001, 0x50, r0, 0x10000000) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x5, 0x2, &(0x7f0000000480)="ba7360ba9a52b5beeeee8e45f7b3c14aa85797b765f712e8a95f3a98ec11aec1e34980768224ed4f55f465e232efca3cd3fe4a99d69038fb2b1ecebe25b8a69655027cf341028b055a869403b13af1d73f576a1a7ffc7b0cb323ed2bf43b7cf14d7e1bf95f41b821c1f748121fa46e7d67d3d53dc37ce3d54c19ed28f1e91efa519780131153f03080cbfd6103ebab11f4d335c6b036ee65557365eccf98be2d39cb52f08264f71309573ffd", 0x6, 0x0, 0x0, {0x0, r3}}, 0x7) r4 = syz_io_uring_setup(0x37b2, &(0x7f0000000100)={0x0, 0x515d, 0x20, 0x2, 0x2e0}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000200)) r6 = syz_mount_image$iso9660(&(0x7f00000006c0), &(0x7f0000000700)='./file0\x00', 0x6, 0x1, &(0x7f0000000780)=[{&(0x7f0000000740)="dc376f7b81b21255cd6adb5c6b5f6b681140180a093685f478d7814612b4d1c3a72c103e3db642b6565732c01e3e733bad1de2c65e66", 0x36, 0x2}], 0x200009, &(0x7f00000007c0)={[{@dmode={'dmode', 0x3d, 0x4}}, {@iocharset={'iocharset', 0x3d, 'iso8859-6'}}, {@dmode={'dmode', 0x3d, 0x40}}, {@sbsector={'sbsector', 0x3d, 0x1}}, {@dmode={'dmode', 0x3d, 0x7}}, {@hide}, {}], [{@subj_user={'subj_user', 0x3d, '\\-\\{\x00'}}, {@audit}, {@fowner_eq={'fowner', 0x3d, 0xee01}}]}) preadv(r6, &(0x7f0000001c80)=[{&(0x7f0000000880)=""/9, 0x9}, {&(0x7f00000008c0)=""/220, 0xdc}, {&(0x7f00000009c0)=""/164, 0xa4}, {&(0x7f0000000a80)=""/6, 0x6}, {&(0x7f0000000ac0)=""/187, 0xbb}, {&(0x7f0000000b80)=""/4096, 0x1000}, {&(0x7f0000001b80)=""/87, 0x57}, {&(0x7f0000001c00)=""/91, 0x5b}], 0x8, 0x2, 0x5) syz_io_uring_setup(0x3bd5, &(0x7f0000000540)={0x0, 0xa5d4, 0x10, 0x3, 0x366, 0x0, r4}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f00000005c0), &(0x7f0000000600)=0x0) syz_io_uring_submit(r5, r7, &(0x7f0000000640)=@IORING_OP_ASYNC_CANCEL={0xe, 0x3, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x0, 0x1}, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000240)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x4, 0x0, 0x1847, 0x0, &(0x7f0000000380)="55918be8e5bfdebca5f40d5a364e1a1c0a052fa57f5f8cbf45526910f61fa73751b81d77a70d1f2fef802ba8d9093befb8c93e44ea7cf42a3275a9a1342f42f472cb821d9a2fdd1be43c7a8a1bc411a7e88ef0c0ebe28846107a0c7270eb2eb43a0c448fb95481227159340b72934a4bbafdeba96c42cc45b9a21e2cbd931e20cbb2c85594902b2b625286d58b345e1a53c72ab949acffad2fa5aedfadce06c8d82fe0d281ac4768398d637f009b5262d301ad8a7fb0bf356a8c4f7147a855e0e12e266afbcd62e5ec1211463b10ae513696a7a43287b4c17d4bb5ce675d0ac6fe4be231bd6cdc82b4d39a31e78ea45f161647c7f66144d0a1cc8ad92700", 0x2, 0x0, 0x1, {0x3}}, 0x8) ioctl$SNAPSHOT_GET_IMAGE_SIZE(0xffffffffffffffff, 0x8008330e, &(0x7f0000000280)) 23:56:22 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x406}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:22 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x5, 0x5, &(0x7f0000001440)=[{&(0x7f00000000c0)="e6919f6e73d96dde7b7308e87784eee55ff6de22ab5f054d479de5db51dc05726618b6f5e4217c6afd6d4f40e4186baa10fa9f7945e3e8c6ed954ee94cc3f2d7e2349be1cc38390e3f2e7be2773785ba642d411fed01334a4714ba800dda36493415af", 0x63, 0x20}, {&(0x7f0000000200)="09adbe7138e1dbd8158c5fb7ce575a5491f2b6ff7d5dda0b040c33d5fefc17020fd5d320254b63e4e47676dd6988cbedac50446c5e52eca3942f2e377a23e8bac8df74a9afc9de309f6c70f77141b4f0327640b1543764d7babd61ce3f325cda1197c5bb0aa2ca33974493fb6e37a742af0adb737e6696e4b4f94a49a3e032aca9dbfc70655e807b2c4ab8bf36f2896908e04fffdf2ba124668ff7f1b982956dbba812bbb89843b50805a2ec2557915334a9154c2545cbf3a3dd38392c746d86ad328eda5d3682450dc929693571a51be2064434da2041dcda0bea04c79850a196a17a0ae41ae30a811d81955ed6931d67604f1069e2ed240c5013349b03bfc4ccae7512a16851229a1b51a0f33e0e7d754ca151ec83081b86f982da106e1145a2091267f327213f3bc9cb8c42a5545310640d7c70d83b014fd36add0b6a67face99f90ac71e2204279255b95eb3fcf793f3a0c21c31a7466856384693939815f2efedd807e5611c64a1c89215c7fe4bbfd1dd9e8a7241664e304a6b717ce4d5b192445593c54a1c912ff3803ea23be435ae0b74f83b02a4c4c57b8fd8ade2da20544537116476294d8fabecb295a7f2671607647a8ea050449b21bdcb57d03f37d104f1f456b8d1f1bd074184958f7d5531cd65c88fe86fb3587a240af110a86ce9c5f5718149f2ccc4f6a9c1e403da95f705609c848956e3effcfd0866bf0aa15545ae0647049983129d5ad180df11a0d120db2a575e364316854e0d427ef295e1f6b14c8cfd4efe6fbf706f5e585e0994e1f49c8f08ed7774d70bbbbd87cb8b961f71a9b1f82802821eb2f1c6ea75d505e22e1f77a6aa46f60b6350dd3c05a45165d9a4f809bcd3c70e069eeee72a08a9ee6a36e1f166299876c78f2cc90e2092f102e9ee5725ddc40eb3f43c6a9126f5ffa2a77f69df4bc0676ea4275c04c4a958bb3dd66ba21034bdecd08c9e14516105996e753b30e6ae5dea1f0e70b8892cd1110645c23795d8978ff5729a804a124482588a3a6dcb3b07ab21b742395852a232c4490a14ba6c18b116935a1889bbe9a42012a6af81c3b6af2b5752be82a8b3bdf9df3a915c86db22549ab9f4b3b6a16af4d23ba877bc4bcace3e078c442eac7d12ad9d6bff6d80bbbfb35e60f9d916d1d18e68d759e8738609c000ee00839fc60f7f998a0af90936e14edaef2cdba6895497d5047916b7b9b5b18ab7234a178497709941c59797fea15e5ab15145a3515cad1390b656a21e74b0338a341b11e29157212c2ff524b86ce480da722d0e62db24efa6f947a11a1d5c36382a20ffc6c1c9839072a17ac522a01eeff7646c74ece51dd4f9487b508069a290033f3a0d7fd092a0d2af4172b11d5a2f8967cb5b8447ab1067df44080cd9474b128e67d748a2a6cc9dbfbb464d5d9b77e863c79a6dc6edcfd935fbf05ff96e7a6dcef3fa09963cf33f2cb06845d349bad48a0c2d4c99307f2d7d44a77925daf0c5b8a895c0ada42c667efdd0605ebc5dbd1193740dfa1c50c37a918aaccf5bca4abece87531b80359c4f91356b0c9a96e605e33c4a99d67d7907f6129ca1597c447189add1593059171670883994c22a89442642dcf5a7dc584be5a5411f50ef9248f7efdd59fb11ff75c6117dcd0e3c1f150fad719a4499a00700df76f4af0c70919fb813d34df22917fa93e008d10c3e0d4f1f3d6874ca877d04caa35ea5c2415c3e106df6a2f09b074e193e6893ab3af2aa70ef7036bb384876d09f7b2b7ac17b69b549db6d89d476933844766b6e4112310f57b182f28c042d5f6daa615f21401f0471d969fe039622cc7dfd0dc0dc7368627044c722a29d17cf77b58bd3e7a69c13730fd1c557c40d391914a624030a3b001ffb1a6f686e2a1e87a29714b0604457be180ed6bddc2ba81d06e8e4863363ef9af9cb02f953ffbd8cbeca1d3f99c3dd1b852a320455294bac56950d33e6dc7d7f0c02a81562e13fc74121075935c138ef7960a749d807a5589f804ac9a819c87d463154fa73fccfd27ebb0ebfbfdb1f2d0b244f92a93ee22d51e4dce7161af350e9d8c608e0d1b0456abff5565691e690d6a93a611e7ca528fd0ff708e4ad9bbe808758463d26c3c972f3c7c64bd43cc7109c66b15c01e3b420569ea8d0dd45d9398167d17690b1957baf958e41d8f3d9db42f49306ca4f008b9958c48eb50cea8fad62467fe7a2351f8e11ff1680e83202e499d1e310c9ecd1e5153ab201205a1e1f39a49bcc1913615fb9b36be283a3c6c7b72e23b4777c221a807877fbb21eabe7e80cb8cd8aa18c8155b3792d6c85d6ed0a2fa9bb4590d6789fa74cc710774c0457b048fca37186475ac5dc7b9c2a243969271332419e839edf18edaace330cc92421db62b475b46aca0898306ce4fe7bcda48ba868dc6c15a214a3fb26b803889e5689bbda8387cd284d71c4eb4d8143efdd78680b45079549397d986ddb37b3018547c3bdc579eca240ffd48bf4b99286ce0d4fa490d8af12ddd5f945d60caa3d6eb13c77d8642dc6304789f118272baa7fcb0a70b96787eda3dd60165b4da5c97197d06dada54edbb4039f22038c7f496a9598260bc8cac804a987705969be1ce248b4af45184ca790a4674bfbc8a7f4af38d4108f7fcfa0cbe47a393525b854bc5b832121dd823cc0977c6d8b87a9eb7e2e854a87af4c5ec91cdc9db14df98fa7467833fb1ca95f45435f3a1f48115b1bbd8215b717ab4b6501dd9b984593a1d75131bae435984e3f5c4568e642e386014c8380ba5d99f0fe6b87ca66af017420a4493526a789543bd88117abe3358cf380d468311894010e29ee44f84f295951beb8304c660eef7efbb588e73cdefdda8dec1c5d45c3b64b5ac851d1260e8cfacbdd22234ce76fd2b9f52651fb5b3ce7ac936ac8bc4014dd4b3bd9dbf1ed348b507c4fdb795cde4435c4f0ec048706e8ed3df86abd9d57c0629e5da38ae5c68791596298fe909014d8e64e80f6d06f79e32c69d09bb6f5776de941857d2f786b3fe9698b3e155ee2a3d7531477194b5a86ab83adbb3547cb76a466fc39eaf06a65d1ba6a16c14c7549050fa095e6ca73b7106505e031e4124764ba593f81b6f7e8d6957716d05eb64785806160fdc2c58bc8addcffb610c53b0f6414ce2af03fced7250c3cb34d6a2cd80da053b9301ddce9da0b9f4631a103e8f863b03ae6d5ef2345ef78735add8ac6196832b8506c840056b4eb4527dc29cae995b06000d83d4161d1c710cb4e7bc7ac504cf4b218a333b98e39eefb13cde0ad29d999b2c5a38616f196e58e85a236885a1fe0caadf45bc15771c3965bdda39f28a0060d4dacab02725760dd5794ed92163511b3d4d736ea3b48116e660d1ebc5b2a333e20b55a05cefd62e73d015f0268b128ae4475b0a3d0132cb83c42b933a1b9418be32af35929fc97ea4a6a98a7f37c825486038bdc8335dec5f6fcb95e785eb2c9132767557d5288c18879936082003331eeccf8651447b79b433180baa619b4b91e49adea8b5f3c76a841a89aebbeb9a81fc5195fd5599b7c6a46ca895a99e361779610e5f6b5fe8c75003d0840740c56a35704da5d9bc3d85bba255e5ffcd48fa19e3ee58c4c3985842191b12b7837624d5cbdfcbf6ab70f37d5462d5c51c1155761d85a60188d2ad494e58c905f668d329a0bb82f8597f4b774e62fd8837832896524a8286660429211658adb069de19a3ac90848350dac3720e6beb925c10b7fb1f9593622b8e3275b336fb8b7671aeab41f23c10e12403278da3af455e5b3fec0c58c1c2df271ee0033a63728c0297920235d16c754574de8c83c31d8430ae5df6624db14c6f39ddc4b3a5448cd2cac409138f13447002f72bb19ddb1799e71d83584a429a59a3f1b859532c0650e3fc9cc5aa6c1a707ec4ca7a5d4d6ae230ef07f847596a610c66f556a1f4164561887fb16c6279a10d4d9bb9747c22b033e79ed7cf12df97a1fe03b86bf5cbe9a1b6a4c1be5425dffc09385a67f556877302481ca3972b8223b0fe2e6811582def2413be4f9a7492f2ebd8c483ccb453c7c55e0fb30a2df747e7e8e4e6190d4e5b78abbd9936d8e3c6b5dfafa3b3c07761edb9b9ad059015c27fecd360badd7daafb36b8792251ecbb007095c4952692dbd71ca11b9a79d98e268013559d52092a85a821cfde0c44e4e91a05b463e360dd6252396b577a4abeb3a7bde71428c17e11bc9a16dec822c00bc99a6658886ede206455f35531b84018e7524ca065fbe14217b0698d1e2e2dcf94e264e734c48393322f6573dabf17185f39b21562a352799cd03b9535c9c0c80cdcec8d20a787e80dc78684ee8238a68393d977af419cf37df02c3a8c93daba09be1a07316dce3c855d77b21b90540692e716439fd873c4a835624d4ef226805983d806476f9740226319af834bf306cc5cdbd4822e89381303d96f37a3b2ea4dded4a36207583f66f4826ccf3125efc0e2573739e54d2dbd75a05886838326d2c2988ccc22f3c880dcba02050f25f959399bcb0df9cc8c929fa96509b540dc898d9b9d108aaf8cd03aa835d22575fb31c7b62e41fd0479f2e6ccbc223dcccd2f93403334e0bc8da7500c325cfa988332b515dcda271a10229066e48944dfddbc86979afba5e7ed9ad98348a42d0e3109f864f0e9dc5695d9039bdab95f8d93ac12573656110148dbea8177f47fa7957bb221796feb6b80fb8ceacb04e1795468117ef111965f105bc842c684208583035cda1058256a5b023fb982228a551e80e0347135d0b78bccef8edcae4b591be6fb87ee5ba8f817019ec5934090898eb030d90e84c616280fd216b906e9a1b692b9c4a08d03be0cf11548a83ccb3a6e4a28e7adceacf7854a610cdbdaaa3471454ad3f0babb570786d0773ea4f7eafecded06501ec5bf2a8c4599c76c41ad29b17fa6a8db6bf34b4a6961811998db459ae57b8695a3dabe33afec5cc1f4bdb990804e2db0efdbe34620726e1f180b1919075a3c7fa60e26c13e3ae0be076b6ff11213f9a4262b900f6aa78f9d89062836ce6c4851c73ea8df345b16257803355193367ff7c422cdd2e2c9599ab47b612fe21aa9e84e0bdfe6eed21c7354fa50b6a4b1e4fcf2d866d0c54550e4b1f01a7578440ed4ebc89c8a67b3944139a2b45833059724884a546bf874c4967f1365f8c388a885d390f5ee8823b41579470d2299b8784011c984183c0c934cd193ab64bcb0f61e5b30435a78c7643880c1cd55507c778642719fbabcbe5bce012a9e052d412b60520b797aa0700a7a97fea74ba9b1887ea80dc22e65b4d17b1f3beb08961308b033ab5a4fccd630b24f78ac27f22ca56be2d19833d3f862e0451b907c391d1a50b4a85cc00022876d45116442a4c258263c3290c67a933495fee3f4ed8caf347443a2fbcaa79079a5138447effcecbe455641218f9bf08d43f23532c8a1d67b50b451da1def1516443337ae2645bee4d0f26e2e705dc36b515332b6e75e4fbd9ae4e07340541de97df2e2fa12da693ddb3b7191a026426ce3dedd4ec6af795bb825c1164efd7069343e049f181a3cf893f1648c82c95328959eddbf1ea18aca1e9f32154c5af290c3c264a7083edd092b78b63283040ae9ee9daf52bd89d1a2484dce4e7f49895c97271d11999d0bacd468690d184033c0aaf426bee814a8364e84c00da4351ebbbb2cc5ce94cd46a00c7e30ac7f986502fbecadc2c51fafeb5253681c0940afd30d14c660db5029d7c5a7bc2f2d473ed78f5833df4158f4d12de556bee650320f86332", 0x1000, 0x3ff}, {&(0x7f0000001200)="d652c28ba1270592f3d5b738252201474c17bf8b281f1bbd5c316cf875b3ca797fa904d343e4f4c50b570723e9adf192f6cab3e7172ccb323c90b47e3d3c674efdde7d3bb72841b19b87f22cb0509e440d60b3c77e4f7142ed20d1f712fdae3a40908471b2dafaf347122c415369fc14b7b64e5d68d9fef9453c08687ccf70602ea91bbd742c3ecda2f4c4da1f4e41530aa36985c239141f795b320f62a82a23a36f41e2fdbba8d15e512359170656e57953bf44949e2015948909ce8580818d839a0c86b9d5ed83a8b55c3550b4cb18b1536fcad93cdb9f3134187262dc3f322c8b79c7dd437b2db8e2c7b9a29d", 0xee}, {&(0x7f0000001300)="f8e0f8f78f2d173792bb775249b31bd1eb22e213b979ce5be5bc1deaa3b6ceaf99b1c81115a00df6523b85858c9ded9079d82381ed021104bf38967982d17ba794fb39ef577d8a87acd6fef99ffdfc47056c1a0a0683fbc3776b23f977e6178cef6dbfb06a52d6821463b73ecc698707a2a29dcd0a878702571a4f1932e2e9b4e655dc57a3017951794ce31a94ec03729b046d6e2937", 0x96, 0x4}, {&(0x7f00000013c0)="88b39da35cdffb4987a28ed6685b566fca38c2af0d018970f1ed92bfba8e127b76d425de049a530221ac982e4f1e110e86489d827911ffad35abb879a2d65333c419c2e0205d079586eeeddb17f449f2020eb4b3310778cf4e3cf73ec02627c52143394f1594c6889c95ff292ee39670", 0x70, 0x9}], 0x42002, &(0x7f00000014c0)={[{@test_dummy_encryption}, {@usrjquota}, {@dioread_lock}, {@i_version}, {@nobarrier}], [{@fsname={'fsname', 0x3d, '%u('}}, {@defcontext={'defcontext', 0x3d, 'root'}}, {@dont_measure}, {@smackfsroot={'smackfsroot', 0x3d, '!'}}, {@dont_hash}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}]}) r1 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r1, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000140)={'bond_slave_0\x00'}) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f00006ec000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0xbc009000) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:22 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x8800000}]) 23:56:22 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_io_uring_setup(0x34b7, &(0x7f0000000100)={0x0, 0xdd4c, 0x8, 0x1, 0x1f1}, &(0x7f00003b2000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000040), &(0x7f00000001c0)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) io_uring_enter(r0, 0x5b2c, 0x89e5, 0x1, &(0x7f0000000240)={[0x4000000000e586]}, 0x8) [ 2939.190189][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.198995][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2939.241207][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.249636][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2939.261611][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.270605][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2939.413251][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.422033][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2939.438061][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.447810][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2939.460493][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.468943][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2939.488664][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.496986][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2939.519257][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.527680][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2939.540408][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.548555][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2939.594196][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.602490][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2939.615943][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.623969][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2939.635575][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.643836][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2939.664315][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.677513][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2939.689868][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.698051][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2939.710094][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.719028][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2939.731972][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.740198][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2939.753762][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.762846][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2939.775947][T21951] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2939.784566][T21951] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:24 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:24 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = signalfd(r0, &(0x7f0000000040)={[0x5]}, 0x8) syz_io_uring_setup(0x4789, &(0x7f0000000100)={0x0, 0x2359, 0x4, 0x1, 0x2f1, 0x0, r1}, &(0x7f00006d6000/0x4000)=nil, &(0x7f00006d7000/0x1000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) syz_io_uring_setup(0x218d, &(0x7f0000000240)={0x0, 0x1124, 0x2, 0x0, 0x7}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f00000002c0), &(0x7f0000000380)) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:24 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000002}]) 23:56:24 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x604}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:24 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x401, 0xae) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:24 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfeffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:24 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) ioctl$FITHAW(r1, 0xc0045878) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:24 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x6552, &(0x7f0000000100)={0x0, 0x8658, 0x2, 0x3, 0x1f9}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000040), &(0x7f00000001c0)) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:24 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000003}]) 23:56:24 executing program 0: ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(0xffffffffffffffff, 0x4018f50b, &(0x7f0000000040)={0x0, 0x3, 0x3f}) syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:24 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x80000) bind$inet(r4, &(0x7f0000000100)={0x2, 0x4e22, @rand_addr=0x64010102}, 0x10) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_open_pts(r3, 0xea288d2b9dfefe67) lseek(r2, 0xfa, 0x3) r5 = open_tree(r3, &(0x7f0000000080)='./file0\x00', 0x89000) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r5) 23:56:24 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x700}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2940.878205][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2940.886929][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2940.930327][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2940.938653][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2940.951424][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2940.959831][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2941.100137][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.109275][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2941.124782][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.133268][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2941.146056][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.155236][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2941.176240][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.185162][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2941.208310][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.216621][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2941.230089][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.238462][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2941.284923][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.293404][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2941.311643][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.322224][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2941.335946][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.346045][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2941.368929][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.378418][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2941.392327][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.400864][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2941.413382][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.422412][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2941.438022][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.449030][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2941.462435][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.470765][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2941.484431][T21996] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2941.494740][T21996] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:25 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:25 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000004}]) 23:56:25 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x900}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:25 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xffffff7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:25 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000040), 0x2, 0x0) mmap(&(0x7f00001fc000/0x1000)=nil, 0x1000, 0x2000006, 0x10, r1, 0x60b45000) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:25 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) io_uring_enter(r0, 0x4409, 0x805d, 0x0, &(0x7f0000000040), 0x8) 23:56:25 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) mmap(&(0x7f000050a000/0x3000)=nil, 0x3000, 0x8, 0x10, r1, 0x8cdad000) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) 23:56:25 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xa00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:25 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x300000c, 0x1010, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x3, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000100)="c84e714f559ffffa6b3feceb104e738027644c8858da56d04131649e2e354f775b4497f2443d6870a15fc1a5e69f0f9cfbacf3df706c90578fabc6beb0928ea94bd716f3580d20c3d2eb8436e79b7192615f8f3ff5e077fcbeb1897b082e31b26fdbdd32ea5f68afd52c9b9abba8b82f61b379edaf1c8b4e", 0x78, 0x40010001, 0x1}, 0x1ff) 23:56:25 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000005}]) 23:56:25 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = socket$netlink(0x10, 0x3, 0x12) vmsplice(r1, &(0x7f0000002500)=[{&(0x7f0000000200)="0c705c0b0520d3e3c2ca2691b5bfeb7ed26c4385d247611c25bb765cb4ae943395b47e1c04c6f31df6356f357378159cc422a50c34b036568769ffe6890a3189f9a959d03f672c6b9bc5ca10a12fc8c4cb9cd56d2e26cd6bbb15c3860c094ec847fcbd4d67b523b6d5b7794930ad9d74bc9fbe275eef42f0330e223da5e58be09765fab7c486c9c24d2fb9f3fe2afc1261b5a5c9988b40c4b34edd17af574fad92b2321ed10f50663f6efbdd9cc9cc614b4a0870f656bf19f8e23db75e4cad5e850d63a8490c5931806defea4802236235256c09a1c6d77f4ec6c8b1829dee0d33d473e29161c79e24f6770c53b5be14ded66ecb25139353f613a5ab1e7648a8a3e4a143c032f3a1bd3d03a8b8b13e1539e49dced86ba714c9031e2b016590156df54e92d9621c8f1bb312abe5be4567fbb253cb21b90f858374efe4b3d56c67fad5b9d3733707eb191eaad81123080fd817863bb7443c3727cced3a3e3006f9b9db093935d1e4de2edb134cba7e138386b1cd810d52eaae58ea655ec7d292c2e35b3af59de0fb6ecbd5956f8a0d6fccd4cf90340682d20b00411c3744a6524729b81e29b508e80d21108fb2fa5dbb1dc23c8a1d95d5107a5438605868f33a6778827781138815082030487803d9b4e231cd53afdcd006ef4417a1f5742442044bdc1820ae5abdcc124bdce9bd2529b0ba1d5a192b512c4291a436374d803aa5bfda9fa92cfad7693aace13e4a7dcce917d98540e2848f2b3792a39cb285073cd4b0bdea35628607bd9d78241584f963d84eb661abf72f3c39bc096c38be06b7c7d76a0ba29a21f79b8ffcb51f21da0b945d5145bd2cdf934b79811e8afec7147f34238c5b8a28fe024e5da3fa2aaed966fd61dc8196ee0a9aa537c8fa4eb2a83804cdd2470170e1e3c81fd8d6dd6f56e488686ea6d43783d7cbbb1e79bb9768752da0d09b33ed6ed0cb52bd660c6a1de3fe264c508373a323e4979cbc4925021a7f89f1d2b88be532ce8290060568f70737a9d57055794816426ded5d8fb94b472b851835a692531ffd0a9f1f7136a4baf0a6b0abee1f701af0638b410cd2bb62ec3c2b297bb86bb18c81d2001ae185f0c74a9500ec13d04c78633f8af7db51f77b81ce4d3bb51098267cec9fd6e83d6140ba5eb00ce1d5ce854ffbc103912d374c3048c272965333b1c85d22f6d2e58d35a38f1f35ed170a403b1a2c67c97eef35a01178b0cd9dd14f223acfc91401f91d03fbf7039ff10121795e088a3f1cceb48f3b3e9d260abdad501c8640b5ae5a8cd0ef8b5687f455d3add3ae43456a2c9d5cdba6adbf50a281a3cd4182cb6f7ffc695715d86b153abe0690ee6d0623f9ed375b1e3561a27e3731511ad0ccacb4e8009744bd67e4d0972d4a6398c74b52412d47b66cc3441eacb2f8facc5b8d1ad8608c9b08b293943b344f4672b95f5dd8195bb894fc4081aaa35de8fc2a95f7ec0ad1003af60da411e5e9c53b815a0867495d1d15f4330194f067183eda0d1f4b2a5d9e542afa273a1bf110e2db3319796068b96dd9f420aa6f0d20ebb34c4b91665c99efb527f769e915dd5d9c92bf2cdfd08af79f28c3ec7f8598f851e0577476829508db053074ebd5c0d705e8b2b607385e7e0b5c8f7a458fe302ee186a85153a326dda5fc6c71989db8df77d86c5977289ac4e22835289ccf4894fd9c77de3190786410bca249f2ecc09964ba4a288c5e23dd66d64986100ba9c466c215bc9b8f10c3ffc48b6ff2ba0cd7805b182ba4799b49e4bacef700328d2efabd4bbb0d41cedef9b0fdaca2bb49135d0babba8fcbf8976825ee6f99b5cb0909d5e83256ade2c37202518465fa60eff451481dedc8a8b2029db27a2ecef2d328991b23cb9b3975e0b766f824ef6d28a2239a4645f0431a74af732da3b6347869523bf2a0c57d8def4e48335b019f3a6163987bd8fd8515b66b4793ce930bfe38c5a0ac2e0bc9ec7eca0272c097d744a495bd843c4bd4b18742cad618baba81567286c15b8453f53dae2de750792752f25649bcdd8adc8c10d118e253b80ae7285b22955b6a877c35963be6cb534bd073e0f678f5cc9d523125bed5e6ff7e00b9068a79e80c9822fd78edef76a8bfab81421b09607561816fda999d3856c557bd3918171459e20a8f41e5ac21f476d3d1c4930965682dc3e921cb3a70cad7f01b5cc2412bed42a9eb1416477e70863d4898a95de439f40cfb6575669612f73bab32d1518229af270f0c108720585b77985cbbefaf22577db7cb728677c1b515fa4fa9a30ff68b6c43c852c8220ad1ca7e46d3d1be2a153185f9e87e01ead44889e034359bdc9ce5fff7899630225b119ebf3a368e0f5b1d1c980918e4447578169948536e218e84540ae489f716d86db2ee089d4ce261f33748451eb95f246c17ab7caf767c762f0b977faa402981c4032b192fadfae48a08745e24304ae869e5fb386ea2564a4db548747c21f47fdc9bd4670e0fcfed5debe52d46ddb6d7913239a36ebc9753078dcc4c222ae1363d3019929f4fbf1ec432b46a827b6a8964704992c499edcc3e708b6bce1741644caa55855eaf5fbaa98034aa26532844ecff5e5534ed04fde3c176c5782092ea8786c35e75cb2d6383d1de0310c9ad774634e407c9216e01512eb5682541b0e50221a60a396f088df3923237fc7ded13db9056792a7fa0fd8733d78e5e6872cac899c1fe120e449eaf83a271a855330583bab9e305c1b7754bc483802df8416d17abb0ef8e53b13c0333d73898302b8f41cffee0a962ca6041317f8ba020588995cfb02745ad0b822c9a433b3e4d4c27ca99a3d7472b67d753440ae71ebc079f9d0fa38f64aa8707d190702e8d26ec75c64f22a5c28263c52afc19dc7dbff509d9f78be670f9892373d896be9fea25c85e8852beee09c73b546a7e9b25e5c74b0d5576c2888137300d642f5142bd95522d4324cf6d5b3772a8226e1420df12c3d63f0a67c5ba4e865dbe5b03fdcee5fa97c0aeda72cfbd27f2c5b77a25154071590ac7fd7d215f21ea72e9efe8f019a0f05ef3e72626b1a27917a889b67d041a6c7439a46d6473ade8fcb94e14616fae75fb6b23804bad6badab94399200a0aaadd066a9822829253d17471a07ffad6767674553ff84ef1d8fdb86af5a9311e60d88a3d09ed377fbf64b19fd9d8af4a11375f3e5b32249f1822423d97b60986dc679d3ea55468674f3eb5d13db63318fa62647f6fd96390b6bec74fa15a3ff5a38b457cff2a4e456fc63413895ccd4612185743b6ced6fb82f1b5830fec97bf9db89a1825cd8ee5133c8b8a2db70de2120f89dd564eedb84e555e8ab83473d71ee01ba22df3d48856e9d4fb4e1d7a6b4060fd279246d1d46042a0a8d2eef05232aa1533e1a21de816aa72049e59f9ea4e192ad9c975afd8da275dea8073a64565b45d4428685d16b22adb1dedcdeb1f119bad97e817252576f6fb2216eb74be7353959d0feadbf313d7baeb5033f77f6df81e83fdaf0298a43e28f7c5bb8d4bf890d618ec2f802d2afb203832d47b6fd8653f1de403fc10f3fcdc978560055bd3ae56415f3f7c0e9752495dc3eae661c18805ce9bc0ccbd249777b8b1c2cd0592b6715d65aaec23c3f43150d3a3133311a37950122bd1535987bfee158ee566a20d1acb9d8687f9c426246867e3af136937f50f8adb4b041a54ebfd76ee3006b20c488028febe6bd15657475c26fbd03b100a77ca532f263817869cd64e6d170ab81f65372ad80912eaad8aa6754a763ab8d503147e16d22ebd942562fbceaac0a5865361dce9b0af1d1d72165ac8c81a9701541adcdf8899d90b1d2adff92882024229f38d008b015ca63bff044b1e3a7d403cc90abd5a1f6f4e5d3ca43b0c101977f65512a1213fd3dc2687c7569d51e7cf497a574aa7bea583bb9f021621371b0086f32c3edb9fbf90bedd9c5aecbb89608f451a1536e95096e37dcef4903fc8f29ef11d521f8e99091737ac98437b070bb055b39bc4207c5e26fa04c2730b9ce0833d4aab90b70b2798c7c5d9f69e024c75fec1259f1b0764bb1e71698c7b07769a64f3439a42cf2628b4a9072b69178cb7598b8f752999a5f9a19b1c9f5b818c0aa219999fed6c2a0ff9a4947f2f61fbd6340e255bfac76dbd763e34e72ed5d0fad1a2632a0fba48c2dd6fdde1ba4983dca14f9438050da7d5a68a31e6a8353a2e47ee6536716ed5593ba44a3a89802ad46fc46261cea1047929ef567dc850b122dfe7f3d3059273edb7368f8a263af2406c05eb7c499dbd5d9a2e0cbc51ae2cf8b1d86dfdd19ac271888b2127bde5b3e99d1951b5d19be2a7aa525ace3f51276f79200d280da43ce617754e61895d4bef4df3b5f75db690ced3c5f790d45220f7e0d6e1c6c041b590fa75749ad94bb9c5873a5b9f8d94a2acf8cc20aca4f443abb57ad0bdf2656428a505d22b1480d5115b30b06732ba88d8ea81ae99e1da75f26145af53695be9789cb5cf2d43d5d19f36746cf227ac5b409ede0b368c492d985dbb07ea821e30d5a126519e1f24e45bd61ca67e7ffbb8beb00d7590ee02c9abdb60bb668e5d5403fca25a6df7b3ad058276159d4df70aaba7a8bc55f2a8e661ff48ce744b7c2babef746691369e53c5a0f6ba219199b8d5e885e04f30ac8e541d55b69a996610d4b762f62653530346d4916007d7dcb7ed5082b4a42aff0fa6769da4521178d7e1abf570954b808df179377b2d975c01798b52825e7a0154a102ef15f5ca3add189629634978a39c9b4f2a7d9f6c44fd55931096acb6d9d1acf1c515fb5e1e527f4953b9dc36048488c6cab1b90e8948e1f79a9611f3071fc62eae4f3e003bd1c08483c52aa1ed8acba6fd0ad0d0c781e47d5f28dbc923590feae10523fd4e45230577d5a938d8bf2b5a835b23f1e7da4f460ab2cca595bf494e19b6e94da6246c68b739dea87ab922376ad5e5ff3456f69f1842b6ee84be4f1e1c15030a7807034f3b28ecb6ed7e1a7025a4c83cb939a2e9245b9467069925680420c9dcda5c9544c6669a98b38930a4b28ebca7403cb75ee8489f5c8e814a3439c8d275ac36f3929bbd3d2454d47f6bd8fe73f416f100d1027338e6fda26dd86c0b80c00a4ab9af1adca8996d41c0a6ed6b5e9388977746a2e5b4f7a49b4e73bd274e392fb586e1b538539169c26fc6437ae69640c5fdd1a421f92d5e74fda9d4f3bf5d4a6f5f5645fb1f6f3ff76cbae4a5acf5910aa4867c14997dc1e56aa187c4ca1185587c5af2f9012683e9e049458092b89ffb3def26247a9d7c8474a62a404e89560f80541936c74d7aa61a79fe81e9a3d67e0fee17511bb81d6d1b68e6be3e40e9acf3ab6e46858bc024f4c38a0f3db066b8a5e25a72b535e486dbd6770f26e76c8edac83ac27bb84c626f410e829fc495980ca2ba56549d625f64905f181d19fc43395ab8564053099404c14ad715ca7f57dd9b4ef0afe60bb6d3c7394d49ef1fc1e1743794a9d73ac24363928e9c1a78e0323e90690d5527c25f165d8704c4a35c4ed93dc93908fbeb70e0d4c4fe2bf11c060995596253a010390c6a968c5e6d2271f241396d79bb4fed3524018b1b5fc3fab2d9a37620c3e0f95ccfd970e7d2aaa0cee9c58c3d195c34951e27310e0fdaec8cf19eb0dbf830daa55f41dfb10b1f4490a9025a7e22044b3f58e44ed7d237071aea2b29ce6c40d5c8c83d812574960392b442f20843e8131972b68e06c1cd2a52d44910a9e5cf0ed6c8ae0c8bf589bd1db704ab8ef510e05e329b010ec1bcd5e57b0767117895", 0x1000}, {&(0x7f0000000040)="f7d045e80100c4dc98fecf578596cf6644175170f3e3529c6e45c41159b220d74de18dd183a719c43ba79c642526f86b02890329c2ab05d0ccfcb0705f2a48845c6b76760d24f8a52b02c0df576611a4192f45015bba3722dc26c8894520a9a8a639ab61e4afa1c6d37eb7271f7c110bde8aa2506ef374667a206a1c28285a40a4c195651873158f813ce4628387e6c72d6df87e4af043b49ebd31d867d0f2bc6d6060c495bba2c544301a9d67f61e2046d7207708f0e8b2a230b9f220ae1f3217419947328e4c150a9b69c5d9fab96e75321330191c7fa64dbfb4eeae8a9bde3cc8135f3d281c4cd5709392c51954565b66ac863379e341", 0xf8}, {&(0x7f0000000140)="136ab70b9e8024571e4110ef1b4254e2b7920eaf0ae29ba6c4f7f01816f7511c3d72ed7c8da484", 0x27}, {&(0x7f0000001200)="9e529822fa05e8061c3d2f14fd47457765028b79718b2240fb9e0892e9f691038ae5c74c854912e0a139ca2321000f83b0de4ffac8652043e7c529c2332c893ab5738d62302f5c8e066a81bd71b9023f80fd9175b9896efbe7b65f55cdaa6431e32b090f515a2d608cbbe9ddbf39769857037e9cd764a6c199e46eccf21055cc242d0deea6b81c4847a5b6bb99527ccb9f51fb2798d02ad77461b4aca44542e9fb32221f1bec08e055d221be33a15c42e467ef8c2a5f49be35ca93df5c05bdd1e70545338bd8112243a9c20f4bd7ee4cca19bafcb168c46c6b7995360d71cccac322e69cb0c42b5ea90fefed58f68f255bfb1b4510c0228d5bd7ed8c07103dc78aa45a09009404508c60331bab46ce29b7729ba9cbdfd5f7dce5ec3c9ff3d103951d063707669b039f2e390aa0aab267e906ed2f5dfddec36999319b690a0210488c774eca1feab6134d0a4113a31f6c8c52e2d32742880fafddb7624b423caa59443838121eaf95f453b8e858f66c0f37b3f705bfc2b958a81017545435479a91fc2f815db7bc0cd33efe9e12f46c1003470a33b630fe3cf2ef4cf066fb372b6c65247adfc0f0a7e87f3f3f4ef5b4365d61ac42893814303b9577e25499b9d05773e92c708de3d1a5fdf800d7da50ad149ca302646440e1140016236f0f6daaee8f5eea164fcfba8a8cbf6d56847abcb276c41655a3e4da7ddc2730869f281e717106b6aed69a1d47ca4d209f37295a4630f219bdee428feb6b9dfb2f0b83f74503480c3d5da5ef4b334152e926264ae6d64fa85e1ad0530e3eae5e61beecc357054841111590ed73747bcc422e02f2285e84c86a0792d733a0f28e421208bdbe2575dcd90f48a54cdff2b5aa90baa2ade5bea9c4355fab33fde5a1dfeafaf7f5fe007d4ed2a25a917334395563b9f779e1f6f7e67dfba4d2fc0031ca9b2f228391a93b6313be04a673adbda9693bb829fedbde044dbbd75e48d50de9b32797626771fe9cb799a1eb2472361cca3110d4d610c191164f7cb514caeb112da774db228a4abb81ac8787cbbbb075ecda0cfceab7f6bb4126431c3f3864b3996d75efd495e0025e8439ac9e9a5bd2e3e20d8661fd3115f894cfe8dba9aa265c0811608c637df2ce118638ad7ae8d21e584e100000f97401ca1168e1694fc4b5f0ea6ccc73006c89787a63fd2b0755f1e348bf724a590234a2ebc5600083dd7ff58c968267855d6f571f3867bc9ed4113bbf305ace40bcaf07248b381c91a97c944fbfb41cc6106039fed96d07864c9252e3fee22e5d7a2d950cf4c20e9e4357740184f02fc017d0340ef2dc3e14d5ea07bb746565d17deb226ee25ed6f8ffe61494fd6237eefdb4e2af2a16312d0356c25e4b5a6c31c1560f41b10379c66c6365c30d03586d784d2222bbb3b2dcdf7e3dabbbe656417ab9bd9f77d3bb22acad184772216596b6abe90fc35b7e875967cfcbd79c171f19178fc0ce2481eef48bb339816f8e6ebef8c93acde0db8185760a1dae038fc8e132b026864fd0eaf840c846dd6eeb174844bc559d284fc0d33f72a36031e3c9a45163f6578a2eb2a67d0f55b9c528f92f9c51eab512809fba07d93cbd889c25749ffe438ad562ecaa580881c378660b9e629e5358cd8b05b7cfc67a250f5c7ae0e1b3473c88cc69453856a9e847243f720a1b0981708f50cc46499c6008b99ac7a9a867afe56b8027dda7c6e1e9423ee1c6906f4dd4148189b988c17abb0cfc245c5f16ac10b81018fe4eb85d4bd7bb0364b0a0b4e53ccf2a255bdea404fb3eea73f1f51fbce57d770ea0c03d6521b95439be64132490658ce76542464eff6ae4718347579968683a81fe3232489bb3d6b2b87ae4415b9eb9269c871091311f840d757f4f97cbedae2ceae63f384e4a498eba37f142ff46d6d34cc5309464a7586f87d895d68c025941b46278f511e628298a1095f2e50095898b95b6b7f63ef2c46c3ac55fbda7fcc31839c820068ef3852637f005bd350a02a61881c372da0d69740734c11c50bba8ba33479910c904595c1645688f215a2980161b33a0267315f6e06981f36ccfc1d2e01fc78d160a1fc9e0ce6b834091639cd820af2affede8ea1ca86966befd1d08487696811d5c5d5a3984b49705a36ae24d9a8ba851e99971a563c28380269e27dfcfd3c5120f1e81e3d15dd0ba677fca1526a2369ea477a7a0c3e91c904ca17c62a47e3dfc1ec721ad5d88c76cbffddf498c9f795c09e5f36a7e5e08c7021ee9a98a68fea96ca72f31330173ab6bebd7a6cc9679c804062d310aad65abf3ef1bbfe6962b1a52417e4b34135de569290d8bfe8f152afeb7e9593516e1da8c48c20c054426b537bcff3a1aa1e1421d07e0c63d57e8e7c1a3acac86c1efb675d34884866ddabb1ec9bf112f8382ef8f2d4b1a642b63b41a6850b3a1731a369f6a7e3adb442dd0c3c5ffacf3ea21ad73a9fd8f69bcec02b6086253b531582e989ae45f5187bbc9628c3b43e9346f1d8ec4982e58d21062fe10a596c1501ddc3ef914ca94bfcb1b5c04a2f215f31350c6703b87e8896e8dbcb88631c83cdef8970f45acff69e0186535e6f475d86ba64ad462f61eb17a61587eddcebe1699df6b0eb53d95635b7cc0ba86a850bb2d32ed5dfc8dad85a7e91d5e9d4eed187febba0cac150cee4fce01c26b41569b13f1935931610de5000f8cd588d6e49c7c9867675b40d49942ebddb732ce9a90b49a0028d0d29d3764aac2ad3b4ed1e68e8f6e08ed20ff8ba232757cdb9eee8608c689c2987918eb14332aa6a154e7bb85db314490c31076118bdea579e5a58774afbf2a0035f2d2831f9530ffc40bb0911e708ce3c6b06f4ae087dc3f5358736662303fb26623c361c833d693700405842ac548f7dfc8689c15bc5a26eafe50717805be0f30fe34e63e3152e50c730860e31199505a4e759f78ac8599559d4c7d705b34e7665c2968ce0050518e5ddb9668c3531dd88ca0cfd6bfb2b76182551c3c4a4d5b50c93db544163160e96bd43b54d0143ccc617398b6079f416eacbed3e66a8521d3b7438cf345a8632f2b732b5f920fbbd6df4ae21ed6ae83e65eab093b9646b1e7e04df54cd0d121b02ca258b6b8e9d25a3b9be1d152f2de6f504592fa7b46afb9b67954a739a3ade54b5331fbb5a4817e1043066774a9f2d56845a1ef043fd08e5325a11043c7feaefb876100f88236067a1887bbdb946b1a66ecf2af255153211d99560c843489c6154829dc3679c339d3fd7f8091f2e8c3f486f5145811625c0a2c1db77d0d0ec85e188710e284f9eb752b05a90431fed8f795b6d38c0f28ba163b7856800fd94f86f57a150a3f9438ed17f3cb5a3c933ac2ccf8242c5b8276ab9d03cde7644978b1a0325a365e17ef0f95591249b82375dc7e2401c40c9b2455cf00546f8ed00aab8ab66bf5b031203c985bf2292b9dd80796197633f505da875aac3b9cb47c42fdf88b74494b84464a3bcab6075679726b5ad54513b47780e0e285fe2fef41cc88cf304c06285bbba705485669a4e404805e45c555e6068f641053923cfd7fd772e4de08575f7fa42796107ec77595993eb0216129c855d33ddec34a6817e33c00f47c61b7127153adc0cbcc885fd2774c1d0eb29fcef3dc24e730a9273346d07f7a622658e8d573d21cb7fb5cf6f2b44fd3c8463ae3b9ecbef84b9ada03f60a8889b4276070d5d929611bff32c06332c2ed58ab55bda6b7fc4fe026a1eeac983f47f7be6d243b4ade48b3bf280d4f48c922183819468f1624f5d48b642ec5977e3c61369a1567ea9af547adda08e36d5628fb12a0dd168d4aa5665c427bbafbb39efeddc951ce927a57316bed5315ff971934d5c1a59c4e840080e0e76740e546a7aea6595081d9f378998c9e715eee8a5bb69bd228fb13fe34f98dffcdd41077acbdd8d411bce6da472f2940c0e4de827c20744f08475ff11de2e14fe926c23c9666d94bfb23906f1eb0153d4786338292eff8a766cc28cc0167047036441dcb7e19c357214d03202a4ea5531909af152169676529762898732cfac25aa5ee3bb0d4c0c870e9330446b4272f451d5cf77b38d979b491f373806da034bb87787aecca8e2519f679b57bd0721889b1a01f345b4fcfcf804676fcff30cc37d6ae615033fbbc12320442299fd8bc6306bc2d3510ee45c3cf7d25124bc8bcb4586a63d13e0552341604a53d70c098d5b57cc8acc32b394bc77a307d2418d037ccc7a0ca736b34d994ace3de12ca990add1d636ba873b2f475d6a9f3cd081b6e7b0a7841c6ab4b044838ab5a2623b99ca5dca69122f1cddaeb44408782ccddbd02e1d60ef06ac0d44f929bbcd3ea38c95b911d11dc7a8ec37b0372f41ddf057e130e03b2dff6210322742d1457d1a9553ac57c11436ea95db1b21474bd8ba3d2f07b93f329c0c6e5cd9ebea9f2f47058f3e49e5c12fd891e442712c7911d3e12821e5174dcefecea073fb33f4df6ff0633d396899f695d18f61b61e625f7a55f59311a815bb437a54352632ef75c27bfeb258129976dde76fef1fd8dc47adcb26e8f45e15d715f1a9df9df41127d8920e61a58bb7c94c2f8ec1254866412ae456df5c3bf6b304f7496a6c2e33d4d25207f95eab8028cb2c4f0b8a1b76977f85fa25c59c5a1438919de10cbf0a1a811fedcd23273536689629193de11b6689e7498597aa56eec439c6c669b71f37020f3bd9afb0ae4b20f5c22d4921c9dbb5278aea238cbb735cb0f9c6f7c0b81bb51636c9e6ab94db21e1c1721a927a2579e7d65b2723ae9178066438bf9449dfe4c87b073f7b46879c90e44bfbca18b41dd961b307a05355df8acaeb445c2ddce64c54604b1406c8456b812d4401b44bd2c4424ff51b04cf68baa1c1746b08c7811ae0f6f5284e8c1ddaecddcc68f29bab6ccae26d555ea60dec8aa0337b1b5f4c0f90e650b7ebad625f00d107a4de24739109961072249a1adb971a28e24f87d9c60e58c2a1f0f3b00d0ba0da2c2140a84fccfe0e51db4be9fe4c832e2418f25dbff1ccf916ab4e6075997042316b95d5c69693fa37179a59b9f6637d04ed24f3e54f060063ed0a7370b179de3c089c3a7ecbb5d646f76198ba30806b2a4e637c52f95120ee13f6a2941e645624a149c2acd6ee5df316599b66755c37bd04a5cf344590b43952cb7f26bab84127b107bbc4f698682e81e284d18a0e07b908bc30a382838415680c32174af21a863a2e34d78d449b790368d88782d40e898eded126609a110941ff6543c5d318b043b2f4b022aa2637b44afa6ab4d8c85b8849913aab04c83e753737e22efbccac8cef30642185fdae76ea7c12d2fc150c743e14d6ce42feaa68ca6baa4d5d288b31c9eddf691000e85d347e043231d3c9a1e3bc97021510a7d8b93359ed5c6c0a7bb6bd7498f61b0eedb1301a55276463694437e4384c1fb20053c9d88b2bbbd35618194ab49b420716e201cceb1da80210eafe42781a51666fc28dd7c5caabd1b1cdf96688befd7af25c8840852b23603f2259b06a0a0593398eefb48fa33d53238e8d08b9ed4b0b2816f535ed146f505eb306f7aea6491669a2d8570ec32fc194bdd3bb9db6104f98c4cd3bee32c2d2a1ef447b9163e02054255aa9f99d6678bef8b6b77197cdbf9ac9f5c97c75675290288b6fc762256cbf50ebdea6a092d10fa61302eda2b52b9454b1f2cd6357fa89733b94d47c9a0476cc460d30170dc94847025726b35df369c1751d7bb1b83142c2d4dec65e385f647b1f5ad1fe9ad6555d5087797f7a7f4dd695bdfa10d", 0x1000}, {&(0x7f0000002200)="7b65e6af9ae06bc401040eb6cdc4287dcd5417a48be344c2b3f50f2a40dfb6b2fde17a3874d32fac6ef0d6db549c942b92abb30767c3cb259b0da6ae3feb4d40f7deb2371d598b962d211b0d75c9f0614f8f04464412d3d9338e627fcb82a782773cc1eca412815ab97a6afcb5077ec9931c2ad84ed3087f26d18d769fd7e350100dd1cbe9424363b68db903467641c648c1b59ff670679ef9bdff", 0x9b}, {&(0x7f00000022c0)="b2e7e3d0c5825c1107b09e0b071cdad285a5bfd71f83f80a75f442265dcbe699b9d4059a58661c82d27d67c0cf4d7f98228be4ab8e96fe5ad7d4f43d8d14ea09ca8297d62f137bcaff2df053af08471fbe44782f778fc95fc9a6ed5c4239a5a231ff6880b8c41adffa685b8c4b9c6cd54769a2be7e4689824e12852f34d00694070acb3a38478e3170eb7c57cbe2b3f4fb548ff3737b46faa7768db213f418eebbd0f503cc04", 0xa6}, {&(0x7f0000002380)="5e5b3ae26d6fe7a7b918406d14e80b359f97d2749254ac5d33e09213c54164170f76bc401d3d00e328162286750c1681a176872c447cd6152eadba9ecfeeb5cf305da22e3833baf3c2e77999c0a2", 0x4e}, {&(0x7f0000002400)="e7bfdf6b3a4a6967624f6256", 0xc}, {&(0x7f0000002440)="569a41b8333748df", 0x8}, {&(0x7f0000002480)="6f9a330f937704fddd4e11e0beb61439c184155ea4a279b31390c8ffe49710be76b96a150e1f5025a3fb7ba9b716d29dc2cc99039d2c7f94d7647c75f856ee0ef0abef75769e8a881b067e702247fa74a699e69554d863d8c74c67b69c9330965be417d32446878762811c156d7a22", 0x6f}], 0xa, 0xc) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:26 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_SPLICE={0x1e, 0x5, 0x0, @fd_index=0x2, 0x2, {0x0, r0}, 0x0, 0x4, 0x0, {0x0, 0x0, r0}}, 0xa09e) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2942.271865][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.280835][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2942.298210][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.307546][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2942.322243][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.330980][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2942.363758][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.373366][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2942.385714][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.394308][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2942.407140][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.415335][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2942.427967][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.436561][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2942.450094][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.458348][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2942.470329][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.479069][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2942.517754][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.526009][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2942.540784][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.550872][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2942.564809][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.574572][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2942.591641][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.600026][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2942.612105][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.620222][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2942.632475][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.641797][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2942.654949][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.663127][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2942.676437][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.685256][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2942.697438][T22039] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2942.705929][T22039] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2942.789655][T22047] ref_ctr increment failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000b543648f 23:56:27 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xf00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:27 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xffffff8c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:27 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000006}]) 23:56:27 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x900000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:27 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000008, 0x50, r0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000100)=@IORING_OP_STATX={0x15, 0x4, 0x0, 0xffffffffffffff9c, &(0x7f00000001c0), &(0x7f0000000040)='./file0\x00', 0x1, 0x1000, 0x1}, 0xa5) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:27 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r1, 0x942e, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r2, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) dup(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x0, 0x0, 0xd0}, 0x0, 0x0, r0, 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r5 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r5, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r5, &(0x7f00000002c0)={0x3}) sendmsg$FOU_CMD_DEL(r4, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x38, 0x0, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@FOU_ATTR_PEER_V6={0x14, 0x9, @loopback}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @rand_addr=0x64010102}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000810}, 0x40) ioctl$TCSETA(r3, 0x5406, &(0x7f0000000280)={0x41d0, 0x9, 0x8, 0x4602, 0xc, "868bfb4a389047cd"}) 23:56:27 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000007}]) 23:56:27 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_setup(0x6b6a, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3, 0x231, 0x0, r0}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000061000/0x2000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:27 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = syz_mount_image$nfs4(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x3, 0x7, &(0x7f0000000540)=[{&(0x7f00000000c0)="d7ee8ad91b4c81f5bebb487138ee523f58a3502fdc2c72d3159a2f6d67cb601f2daa6465ad59031d9e894b03ee5f5fa35e", 0x31, 0x7}, {&(0x7f0000000100)="1d31755b1b9e593fbd5753e5ca2d352d7941f5a998e61ce80921fea9ddb506acd3d95848f3", 0x25, 0x101}, {&(0x7f0000000140)="2de2e1e381343a82116fcd9444e50ad766b6d777c2a3125cdba06a3f71", 0x1d, 0x40}, {&(0x7f0000000200)="bee2bd43233dab50d20b91ed4c47501d3279a206e60205841a39afef8179b2f3cbcc1ba118fb2cdd4fabcf2b49c3009fc387bd69aee3e98e464a05dffad2ab05bb4451bd1ed2c7eb1bb39e76b41e22087c804412cd219aad0dd4dfc6f9fd35d34a26a399d2d5adce4f087f5999b7f817fa0d694a2dfc608f2becf1d701f37b140308b7c4cd9799784aa138e9b984d813b923465e569b363227cd84f5a40f05100362c3631d60dee6f4ebefada5013591bf155919487f0904e2f456bb8b44608ccdca35d6f34a3762bea024a8a57d3ce1508165545e33fd51447ec90dbddd947a6c52e135a7ff1952418004f8e5c0c0814bb780982d945a05f4d2c94748", 0xfd, 0x1ff}, {&(0x7f0000000300)="b147cd2faa383e10789d84e19915c7b04cfd7a57e109f9b60b4735f5ce8b4422be922f73554142f9ea5a21dfec8ea00e92f82a3fa3674946fde457ce1fd84255ccaf252cb0c6beb14349ad93c4a357868b05fa47e78632913117dc12cdfe6831304677f0b877db616870746c1b0d3d0fd255f6c13b2210d0f2154b1e427bd08203d8398d80c00044d6e6d5f22b08003bc73eeb44ebec526251fae6519224c6812a2206259556cdecfd0abea64b42f34c846edf91", 0xb4, 0x5f32}, {&(0x7f00000003c0)="ba67a145562f21ce345e10f167fc0dc47e2452af3f95e363eeef75cfa3c0bdf8af62da7eb752dea8ec4bfc45cc710edf0c65c6ac449da38230c3aee1ab5adef305644a1735f8e779bd6d0973b4896028c79a7c75025d237934ba1184a0c9a336c65a2ab28103b5e252fefff6ed128ea8ed9eaeaf5c563625c32d24dd334fb923e4f39cd090f67bdf0cea1040326e8a17b47f28dcb5cc415fbfaf022c6bd6e8e002d65d118b3433cd82af64907e18b3016db64b7f27e039f08d54333c8f0d3408", 0xc0, 0x7}, {&(0x7f0000000480)="e5116fb59d0987f15eb9114a223f6c7a93ab49922b26b04adac827e3f189bb9f0a746bce7b2a636046612e38f6e5ec8f5402c0483162401d17a01ad3775eeba970f6d9a9e2505fd04f2149928d362e30154a496118a82cc9a55df76ff3e7284e683c01a898160217592ee289a702acf7edadfc4e5e092f8e6fbef35ab29bf142a4b7c282c4", 0x85, 0xd64}], 0x1, &(0x7f0000000600)={[{}, {'*/*^#,\\\x00'}, {}, {'\\)*)'}, {}, {}, {'.\xcb^)&#$\'#&'}, {'.'}], [{@subj_role={'subj_role', 0x3d, '%{@&[,%]$'}}, {@subj_role={'subj_role', 0x3d, '$'}}, {@obj_type={'obj_type', 0x3d, '+}['}}, {@uid_gt={'uid>', 0xee00}}, {@fsname}, {@subj_type}, {@smackfshat={'smackfshat', 0x3d, ')\\[\xe1-,(&[(/\\'}}]}) mknodat$loop(r1, &(0x7f00000006c0)='./file0\x00', 0x8, 0x1) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:27 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x2000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:27 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x1000000, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@msize={'msize', 0x3d, 0x20}}, {@mmap}, {@cachetag={'cachetag', 0x3d, '&'}}, {@afid={'afid', 0x3d, 0x1}}, {@fscache}], [{@euid_lt={'euid<', 0xee00}}, {@hash}]}}) 23:56:27 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000008}]) [ 2943.898212][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2943.909400][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2943.954411][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2943.964758][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2943.980800][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2943.991291][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2944.134485][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.143330][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2944.159811][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.170258][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2944.183983][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.192995][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2944.212931][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.222145][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2944.244631][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.253738][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2944.266474][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.274938][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2944.322423][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.330597][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2944.344674][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.354454][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2944.368221][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.376724][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2944.399689][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.408447][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2944.421392][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.430476][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2944.442814][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.451384][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2944.464528][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.473317][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2944.486424][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.494877][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2944.506711][T22083] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2944.515305][T22083] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:28 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x20, 0x0, 0x24e}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) r2 = syz_io_uring_setup(0xd9d, &(0x7f0000000100), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f0000000180)) r3 = syz_io_uring_setup(0x21cb, &(0x7f0000000000), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f0000000100)) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r2, 0x6, 0x400000, r4) syz_io_uring_submit(r0, r1, &(0x7f0000000040)=@IORING_OP_ASYNC_CANCEL={0xe, 0x0, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x0, 0x1, {0x0, r4}}, 0x1) 23:56:28 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x2100}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:28 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:28 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000009}]) 23:56:28 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffff6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:28 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = syz_open_dev$char_raw(&(0x7f0000000040), 0x0, 0x82000) write$binfmt_elf32(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="7f454c463f990804000001000000000002000300da000000170100010000bf0020000100109b0800080000000000060000004ddf5a6406000000080000008a00000006000000da580000050000000400000002000000040000000200000007000000070000000100000000000000e818a92e4f172be8659d1cc20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000af0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000039c4fa7bd057d100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400"/1668], 0x684) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) read$char_raw(r1, &(0x7f000000f8c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e91e35c863c4f6c7a431d66bc5e6ddfc6efaf537dda7a7582d85cc9ea50a01eb03e3cf995bacf23fa5c0c001e649f239c4fbb06bff1cbac3b69904f247e5ab2dd21c675156c1ba4e3b87150ffb8e2e3c5861e9d99abd8cfa066f0fedac2c4635a9fd8460f18dd232620cf8b84a1c54187cc9c8d640eb7d92002e61793aef4e532a98f4277b748a549d63985102742cd9db2274df31be7b1fa7ce8096adda22fb4e1afed4"], 0xee00) 23:56:28 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x30) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800007, 0x10, r1, 0x1c48c000) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r2, 0xc0406619, &(0x7f0000000080)={@desc={0x1, 0x0, @desc4}}) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r3 = socket$inet(0x2, 0x80000, 0x400) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r3, 0x8010671f, &(0x7f0000000200)={&(0x7f00000000c0)=""/136, 0x88}) 23:56:28 executing program 0: fcntl$setpipe(0xffffffffffffffff, 0x407, 0x3) r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$TCSETSF2(r1, 0x402c542d, &(0x7f0000000040)={0x3, 0x9, 0x6, 0x3, 0x8, "dc278fa4112102e4c875f33f907e8fcdd8f960", 0xf6e7, 0x4}) r2 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x4}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0x40800}, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f00005e5000/0x4000)=nil, 0x4000, 0x5000000, 0x12, r0, 0x10000000) r7 = accept$inet(r1, &(0x7f0000000100)={0x2, 0x0, @remote}, &(0x7f0000000140)=0x10) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000380)=@IORING_OP_WRITEV={0x2, 0x2, 0x2007, @fd=r7, 0x4, &(0x7f00000002c0)=[{&(0x7f00000001c0)="9ece170ef9af445e33e0a55e95b460d388c1b76a8a2965c4f62ae3da8be6fd46e625", 0x22}, {&(0x7f0000000200)="0d971466fd9824db5a51ba89f8266a3a92", 0x11}, {&(0x7f0000000240)="d365ebee9d15d895713a7a76ce69c6a74ac6513985f78ae36ce4603d1d404eeb408d903444cb6ab6ba7334c88abeeba7bb2cab01347962b4b1552a46c24cc61ad6a9ad8be3f8e8d2", 0x48}], 0x3, 0x5, 0x1, {0x0, r8}}, 0x4) r9 = signalfd4(r2, &(0x7f00000003c0)={[0x34]}, 0x8, 0x800) io_uring_setup(0x3dd3, &(0x7f0000000400)={0x0, 0xf355, 0x10, 0x1, 0x6, 0x0, r9}) 23:56:28 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x3f00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:28 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = openat$incfs(0xffffffffffffffff, &(0x7f0000000040)='.pending_reads\x00', 0x14600, 0x50) inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0x40000000) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6, 0x40}, 0x5004}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:28 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00000a}]) 23:56:29 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) io_uring_setup(0x7bed, &(0x7f0000000100)={0x0, 0xe9ae, 0x20, 0x2, 0x3cb, 0x0, r0}) r1 = syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x280a}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000040), &(0x7f0000000000)) io_uring_enter(r1, 0x7d97, 0x835a, 0x3, &(0x7f0000000180)={[0x3]}, 0x8) 23:56:29 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x4000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:29 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00000c}]) 23:56:29 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000040)=""/140, 0x8c}, {&(0x7f0000000100)=""/33, 0x21}], 0x2, 0x5, 0x80) readv(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f0000000200)=""/141, 0x8d}, {&(0x7f00000002c0)=""/254, 0xfe}, {&(0x7f00000003c0)=""/75, 0x4b}], 0x3) preadv(r0, &(0x7f00000006c0)=[{&(0x7f0000000480)=""/91, 0x5b}, {&(0x7f0000000500)=""/203, 0xcb}, {&(0x7f0000000600)=""/187, 0xbb}], 0x3, 0x0, 0x8001) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x4, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 2945.739435][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2945.748233][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2945.789656][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2945.798398][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2945.810442][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2945.819075][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2945.956988][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2945.965180][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2945.979884][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2945.987894][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2946.000047][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2946.008557][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2946.029053][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2946.038110][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2946.060014][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2946.068497][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2946.081447][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2946.089961][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2946.137843][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2946.146584][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2946.160591][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2946.168687][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2946.180866][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2946.189452][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2946.211689][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2946.220022][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2946.232389][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2946.240410][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2946.252354][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2946.260741][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2946.273796][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2946.282138][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2946.294537][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2946.303650][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2946.316083][T22123] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2946.324110][T22123] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:30 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x4200}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:30 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xb00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:30 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:30 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140), 0x20000, 0x0) mmap(&(0x7f00007e8000/0x1000)=nil, 0x1000, 0x1000008, 0x110, r1, 0x9a87a000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x280000e, 0x12, r2, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.net/syz1\x00', 0x200002, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r3, 0x5000943f, &(0x7f0000000280)={{r0}, 0x0, 0x1a, @inherit={0x58, &(0x7f0000001280)=ANY=[@ANYBLOB="01000000000000000200000000000000d2f4000000000000cef7000000000000250000000000000004000000000000001f000700000000000000000000000000010000000000000003000000000000000100000000000000e3ffdd5f0ff32710a2027bb445bcac96e47caec857b03cd7db652f1a680977bad438c5e54d5097b0049c0eab5c1b73029843291388577aecba6284a98a6bdc20a43ae64b284db55966a588289604b14c8036c24c31dac1ae9b2de8d099ad7ada4c10672bed3342ab625b909f4f00f101263e02f1d50a91ea978dedcbefa10dbaca8f4ee78909603c188f2ab7b0554fe20f7d24c01e67a561553b230f5617ab0cba898d3f197633433c27f619385dc429fd9e6d5555a807f6758414625c8d65aeccb331"]}, @devid}) timerfd_create(0x1, 0x80800) preadv(r2, &(0x7f00000016c0)=[{&(0x7f00000013c0)=""/179, 0xb3}, {&(0x7f0000001480)=""/219, 0xdb}, {&(0x7f0000000200)=""/104, 0x68}, {&(0x7f0000001580)=""/205, 0xcd}, {&(0x7f0000001680)}], 0x5, 0x200d9f, 0x0) preadv(r2, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/4, 0x4}, {&(0x7f0000000080)=""/47, 0x2f}], 0x2, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:30 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00000d}]) 23:56:30 executing program 0: r0 = syz_io_uring_setup(0x7b2e, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) io_uring_enter(r0, 0x15fc, 0x77c2, 0x0, &(0x7f0000000040)={[0x9]}, 0x8) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)) syz_io_uring_setup(0xe86, &(0x7f0000002440)={0x0, 0xc3a5, 0x4, 0x2, 0x208, 0x0, r0}, &(0x7f00006da000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000024c0), &(0x7f0000002500)) r2 = mmap$IORING_OFF_SQES(&(0x7f00006d6000/0x7000)=nil, 0x7000, 0x2000005, 0x40010, r0, 0x10000000) r3 = syz_mount_image$msdos(&(0x7f0000000200), &(0x7f0000000240)='./file0\x00', 0x1, 0x4, &(0x7f0000002380)=[{&(0x7f0000000380)="37b7ce3a3993adb33b326845fd251298519ee46ce9e5336354bd163583e03e7f97c3f05881be95e5702b5abc13ee1bf1279766fec36d2d64cfe1b86945ba89a9f9ce5c1f5452468cdef24879f3963ef07f7236f2063608bf4fd5eaf7bef1e99d57a2af7c75f9205a9536b5c4a1370c6bc20b746c0082c7eb74e2476b4d8dea738c1ba5d8514032788de6a60d595de94232778e0a48d2ddae2fb73ee50ece7790a717ea66977902769dc6f81aeda48dbfecbdee340efea5174712397297f49e68ff6b0d312f948eac01b6eebf1faaae581869b0abeffe1764b210c916a44a17db3a7f3f6dd874ea1cbf76c61a3ee031d3a84e7278d45980f1f8f2bbfb3799b1c2d8b8be4e9e02330cc25678c325f5be97b337f8e1bf6d2c21edd63bdd9ccca674a1fba98b9f1f31bac822a710563c777e91605a16011a02f2d84188b5330ae27cf602ddd2d701e8cc1c20e19640714742502d8bc6d7ec08d91d61ed9cf450d0991eecf6d6f02adae8d9284b8440b9a1fa0f0c4601e3ecdb2816833294e6e31b459de0298204aff2d61a1c70966bcd22f4d9818d1d93f621dddbe1f1a43a3b45481226e4a037add0f80f2d50c59419d185f75027f99854f86095f12db5b08afed28b0ef81fc3747bfd7b467b661fed3f6b23972ebe2e63560a9c549c16e0d71e3b3f6786d78869b56ceee6c96c4771a467acca6c0ae46a1ac94152869973f242b87334ba840326a0a1a7e1d0a495e959a5a03e1c701119723cd971fe5971ff28c0dc11f53beb6a29e2bb448dac3b5e66f89bc07289cfd0914ba9b564813542173073f61a7216bfa295f4feae2ecedb9d55364ef492529f6325929b8545fb4ee57ef91f68c559859f430b85a7eac106e922370259e0bc248d2ea6f05dcf657f3838bdff65c7bf79d14c53713f468301d542dd04deedef3113c2b7d386b550f5771bc236a0e16fd98200d0245ae53b782bc4ba4819ead73f6d20cdf9250fb67db62928a6cd9df3b8af8e974ab5cfedbdf5c1de007af8a28a5ff0e0c2b2c8f40960cc87c86f7ffe60dbe4f14361f574ca1951b2ce71cfa96618e4232dccd73bbf014b7e97310384e6e1b88f396d743d00b22e766168c983a83ee8b3e153689833525810ad704b049fc673f3c7311e04205841298cbde53a02cfdcf3845b31f6523aa177db2d4bfdb9ec50c270d0a2626615c07fe56eefcb96b09a87b0fae5c8809d760ef59d939486ac257c0a5fab3bb9e598b6f200273386a68d19476343b7687b8a1de08df8ffedde56504d00b40bdcfeca98181666e2c16caa8ddb267351657ecb44bad6b5efd8fe2fe29869c6279738c7494efc78ce77b2a062bec14e350b1249b0b11f0915b1284648197e66c85778c5366ea7b189cfe1c612cadf9cb2080393a107837fa794617a0c50591e9516fe3a4d14e60276203eb7c5e2e89c30b9122b78976ea97c7a5e271274f261f00c45f99ca691ca577c4776a9bdef1dfe3bd33e3c6e812b3dffa6b92e2e487356d89e75f03e6b9faf5baa62c78fde11f5235b98a9af64454fef6fbec3bcf1a3a39bbae76ce3e612b618822ea348094395a41f89f4396a71156c38587b58548fcf21253db52a65aeac06c385977b63d0ab6379c2a9ab2dec915d6961d1a7f39ea21e61164a906a5cc99139880cb5ce35f7220d71c0b38a2d26845660a83b0af54eeebbb519394c295552fe90cb68de64150c1632e6b11456fe6dbbbe2609a882551e2d4a4c0a92db2ea3dfce36a6e8e3e5008f36c59b36672a5b1b34385211629e874be09780f572b0bb56184d9305aa140c32c070eef656dcf9200fdb20c823155c7dcd74918246e9ea9b2b213783a8dfa7366d9f6a438482070bdfc15f8cdddbf4fdb13eb76623b69def867ce1f73d7db6a5253e5fbe6a008a3f9ca6298452dc0e740d661b7e0eab67d493eb90942c63a5e7397f9de76af997d0126811bd474447d295eb5c02ed1a5454eb3acfc1edc3227a36eb25766a4e737ab64dc89968f003a5a24e679167ef61395ce62dd8eaf1dcc0d8f278db6716b6e2fbf8dd58309c0de38c572fa256c4d61fde10a321d376eb64c9abb7cde1af01777a9b2a13191efba5cc25e7d948dda4fad505894d60ebd0a84b2bd90291c90df9301b365bf3c0e4cb284fdc0219289605a9105fc562c81d53909b6e36e44bafeb39b1b7592d424cd47c0f6d66c4ce8f9983cd9c6efd2f27a62e7e939b97f71130e4459f9d4bff576d6cdc461bcd5364cd1da9a1fb3ee6de889eb9c1360eb81717fbd6d5ff8c547bf0f23a2561358b3f42057f8ec5b50bef3aeca5d4c4fb890a8fe607ddf18539a89e84df10683fe7400d79cf582ebc8317850f036c883fecc10d831a824317c562986a7557c525c6f9d641452cda8f8b4b9b4e52b3ade0575e1ffc19d8d07b86abc42cbcd88b918099e486440221edd5bb96d7c5c2a1b8c2fc2e9a366533f0f49c291af4116579e872870ff5fffabe7d97bd4e7852d36aa54706cc7cf928ef7e4de7f3db9535cc23039506e5ea6c5216ce568cdbd90a289e7ff7aee41b54135083d26dcae7978b364940b6a2901c6f39597fbb2e24c36431894dbf8c751fc41c5c72f238116fc93ad7df678b2d82834c8e8e330713ae46286f98056fbb049ac632bf1f1eae34e7c90f30658fdc7f1399863c61e1307b3d2eac4e1d2547b2db1289bdae7d271bade52535b01e8a85d02c6f153dee2394eb46f220cfd95b350ab080c9c4c7698f3fdcdc478a6411bfc0cd6a87d6c934c2c5b005957c6bca7fb69eff590169d1c158472bf10b8cad0434216ee443caa443842850ab4d9701496535a7508134c8b0bb0c16e8696af752f6126fd215406a7bb3ec6228d5d78f67ebc2233a0bb609bac2cbdea3edf955e419cc3e26da6bb7fd4c8205fe8ee33d1b0960f95aadbb7e30cffebd5e085206eecbfeb54d7e2497c9468caec3dbe0b5aa3a6ade26a4a2076ca1092c5e5349d9d60b95c5a89dcc3ba239d73408fa9ee621436717b7dd0f092cd7dd2e18a964341dccb719c35a8d55927f96b448e21ce909c2606e034cce48f449ccc82f1bb99444e103b8b83c4119bf12be16097a4fbcd5852899dcf2840af0e84f1310c971d59a1ce8381f8285fd784756f4d81e5f639e133cbe5dc1fc2b694d05f20b140b307f8ba6d8ecffd62ecc4b62d712f8e87e333edcbff2c45332e32ac536ca7ba5c6bdcd7dbbb754edbc079d7c1a9903ebad0f1858aad9486c058f41adc2a46e01b11ef2375d728dbf63ea1220ebdbbdc5cad06bc5906be3b2f6487de5678b4391042bf0c4f6d120705c37f2cb2d58956d86f6e26828d0418f8a11b1b814bdb9dbdb7428d2272d9ef7767211e810f8db4d71c855587db883320207c63c6d3aede40a393811bda392b61a32cb56d4ddfdc4b9486e508a878d4225e0c9c8d76beb723958431bdf29327092ac26d31a87bb91d859613e75abf04db1e3faea9e7d94a8d23f2114b6cce30532501958e8197f84756f614ea8583d30b9e54156875a67fbdf77389a78203ff2776898f9530f305bbd0c921463876a26f1dbb270988730836e4e5faef2fce0e7e81d291ce506a3d7dbd06e4d467f7ebe7dfbe479c4a4fe15ab6ddc83e081a37c2fcb3f47423f0f388068bdf2915fdb5e81bc323d12f6686bcafef2d9a9d33587f57b71cd91b52245db6a6198157805e820184409b496c28cc07c09523a3d10ab0b3efe13e1e9944942c7364b0c33e3a8b1383ef08cfef230318a94937e57243b304e8acb3bfb1e2b001399326c6b5e11e7e93089b5dc2f03b28546249d08ab250b6b6d778cb24ca01d73c2224183cb39dc33b652316dd19467e3ee26e612772cf0eaba2ef2981b7bc916a739cb93dced32092d4871917db4a241277b1102e693c2397bf69f69775005a1d7a69ec5ee87e6c13560286ec9c5a09e0f4bcc9fc983e5049ac87a13d7ec59f476f98ae481ebd8d16c3c2daf777971f7b9a76cc9057c36c552d951e20462b4bfaa9be1a27dcee57cd03152574a40b80b0e95df90360a2bcc1f094f0adfe69e09dab1cb6d26686a2040a8980c5ae803a8e71c4f6965c2f0bd945fa3b882709bd9d5b42b83aa153a4cebc1b84fea456835fe94bd9af24793c35929cb4ac3bc019d4f24ff610a1b84ad33f2577f8d2257f0d890038ddbbb48dab45ee14a4ab5fa95ed6ff4de973536bc248135468d28154545e94fe07a41acee1cc74a0cba425dbc3c6cde6a457934b6262769e07d26b5012765dc5e4af620fe6002256e5637fc1091b1029f440b738c0253628adcb0a848bdb6d0d03580340c944fe8e400a11e01dd84f6bdec7a66dfee38450ebca92c7b082dc66eeab43bf2295456ac34ece9d34661ffaaf9bf61771cd933b8dee4d9ec5a23bb2094f5377d76234083b2074c4b20711c49b628e5dd3cb8907f8e4d35feb7cdaeac550e85933d26ae3be335b971f62e9ccd27e3bed4365904a1cd2ede785db635cfffdae079942d00c7886bad25288ff499f87303c5016b2034b58ebbf376f9f735e90096f57bc5a77ac4688db888ed080975fcd38de369f5a4d70b3204e728ad048aa27335d0056ac98fd0ef4c91521c33892c7aeadea9c53c3cecccf150bbc303a576c8be816223880c7d3a4e3494d03b6f31df518716df547209bc43342ebaadc44f77e1038e06ae2bf9236b6aff3a9b0a12b4ea5ec5bdb97867850d27c3976ee9dd64210ee1d1618a86bfd3b4d3c0a25c1dbe693a9ae6d361d62d104e5763e63ebcf8dd6ebb43aa09e386b193f8e8aaa77bb66dde9f92094853a65b96ed11e6cc9c2c80a5b6cb676ce742acf742b12f972ddff2d06ad526b5552d721863f7a2495da811ad883c080381ed88143e59b39ee457b0abe7854b074177bcbb07202aa4244022cf5076ff1b539796a442671e9d5320d79e13d20162c71074d5d8576ecc66b968ec8721781573e408b813ab5719c4ef5ef68855550ff706eee14eec0f7a1cf0d314aaf389f93d8a1c164f1cce1e2923fcb0d9e1b0aa636e13df3721acf7b80b94af69602a0a6c9faab2290d52e3fb0c9b6338d493d6413e6954badfb4ddb601d1b2a9d278fbd624c279062ddde81d938b4878c14e883f88e73891310a997c1c1e6b60093d0b5de7bfc150f7a8f1b148fb30d0461f5ab22c436863c91d2adb884abcc68392ab665583e08daafe60337c1bb8ebc5881198624ad9bdb19ce4d3200947261609129e2873d3180ef161abd5c4ebe1401aeddd6e48abd05feea9d562cdd4eb6a3753548c982ed850d75389017dda60d0044d50514f6352efbc2d23e75dfd4d4fb5371b3907a371a57f528a3af0c2f029eea6f3ec41beeee2aa31fa3e848cf750ddc1bd1c2e7ed5e8e5837de2f13f34dfa818b43100150e8506ceb51f9ec15753a518381cf601e84097a8cb46effea50e37353c7086d25f2d97f55631dda1cd026464c58dcfbb71ed68e158a1e07a78e60f65c8c7757d3d09d353b0dc15ed6c00ceccc28ebc7b09cca13c78cda3344bb47b46c8a01bee7cfebbf869934c89367e72197d1d9742a2ffd430dfc6e610797ffcfa31737c4778fb94dbc4548afd8a4d500ed16b171e9a600ebaa23d5aa32efa77df40ae77cb37fe4cad5a8844802e8b4afd738e0140937a06695f42406d66f5b38bf9b022853fbe1d747f0aa634a6c83cec8ffd4992158286ea0d15b8c7d273040b658e516a9a13efddfa9ce878fef92d70937b008018a1808f88aae96b1142581e387ad7359e008c09c3a0b141b634fafcb04bd5437c2c2259ee8cbdb29359b66d29acf1ce58570dfd", 0x1000, 0x7}, {&(0x7f0000000280)="aa1a45299a7db7465ce4b52766f623125b6ab36f1ea8816885d12cb58b6d01e04defe5", 0x23, 0x5}, {&(0x7f0000001380)="ac8ceecf1cab323bd66df39db5c45a470d7d0d9575bfe8e5725344fbcee2b70404f6855eca55b457e672512257dd8a31b07990e3f27bd21ff3ed837455e4b26f509d02bfd9d58f96b8a4a84fa4f98bd6c1a9baad6b06d5c6ff70c7c2dff0fef655b815c74ee5fc2ab7f7640ab0a5e2f1aaff06f1f9a11ae07d90af303e1e51f09bc292f92ed9d44edad70743b1675a0a165ddfdedc85a234d8616a788c759ab3bf87c9b918e60adedb27d1df064a56f1567fd5d54996acaad0a8af867553160b407a1112ba824b4effae2832395a45414c890a014991d1a630506374d8a9973853f623a00ec317965c04177d28e9419b68421fb6d4e4d078983145078e04e567c26bea6a161a957ef0faec4aa0dadd1c166de4417535e34e32d75634345e8fa0370b231cccaafc596c44b37293c338e8e2a5c487c22e1a4127a2e43f8b39352c112af177f257439a94712a8d48a9948e843e09038da5981d5234ad75f1e072587af6f46f28b2ce75e2edecc67ed7599142dfee943a676319c1f99963dee185a9d8ba7986edf3d38e5dc408abc51ae3a67b984ddf493daa4066f87167516b099765ba8bda56bcc651aba49869c539cf22f73fb65403165a99df1cba4ce670aa9932c3e6cb88d58f5ccd56e86da3e9d320b27421d94ea711499792c3abb924675bf9135c7e0554f65ff89bea7664b5a33420ccf41dcd7f579297dd1cb9fdb772ec85d454620ef31d4a50ced0459498c8861904221f6512cae0543377196cfac969dac8013df7e25e90400130ad4132c1c3d2ae2b404077c5418206c26ab9f0a8ee10489ce79a1e99ceb1464b65a7100a61e29c98f35740462878590b36b64421411b730d26aebfe16e8b46d162394b2880d6878b692f109740c927e9baa836dc5e88c73db8e9eebf4a8b131cf14069123622699d6b02c012c67be1395e8f778933437e5726b4d9d363e40e481660dc42ca402067f7e02b83c6c17366785ac43025db0d07043aff40119144276bf2c861549839b5df6ca2b50dec7c86268cf5da6fe3446e50b223f6ec209ed57512132e7db8d8f23804a889cfc1621477ebff6862bbea850c04d85d33ba69bc220454a9c96b5aa99df8ba9eeef200544599aaa308002a16dca1b060ca8f7c65b173b23b15f3e5ca4acfc9898fe0a3750856d96a15b9f64e3a04570e21459984ea54fa8b11312ffe70cc6a973100f64dd96a8d78cdcdcd06ae0decbe362365a3ab11936137afffb5825b910e1345e27b06c1c8eb5f8cf9a358142b6904857c9a7c7de11ebe044c4f00e70430e7ed6f53a72a7696236013e090c2465ba737a66e810824050e714d81e4cc4df72697918339f6d335bcc034908fa9aea166b3ad39e54fb4567204c9a1416c9d18020b2ba7064c77723a0e12bfa3d33f3013d1f5284b406f9b55073023b88d5d635ce4920627e11bab943844b248f4caf934735accd9b0bb2260a2713f88225e723d4f74b5a293aeeddb8c5126327288176b44da6ef82f6dcb557d22036584b3faf85c52271ed5da0d35294f63d09fc529812acb1adabdfa0d8ae1ad131cb95beaa6fe615281a1c6e611e585920d64e9b4e700d03ce172321391d2efec6bc0d7cd13699b7e10a5dafd3b00b03dad65ba224f14758fbc38838bbe0eb73ae4cfd96cec0b47e7536c25cf2f06a034e91f80d3e12d38d5fab735d878c0f90738d0096fd30043dc24c62a6521817f7430a4adbb836c69f4bc851f530c434b9ebfa041ef6a8d9d68e11b2b12de3a42818a2f2be8a416271ce86f5ead94a3ac7dc263e606acf40b54b7c3caa2dfd35f57d89261c1476a2ca8660423e6ecb59f3b93737790bba7dad2269de0e1fd6ea97679886370038177e0a86bf5028614423192d5289504e8cb01faed09dcaf9aeb72b6887a9f1a9732c83a320458c60d1b8867782895ebe43e4206d9265dc97566ba17f5178ea40fbb8456d64b8f526c8e228ac802d7a7e85416d68c163a14bce8cc8d1c21a15c8fcf4cf2c3e1f0f020cbfa0c77ee4902f28a7ee696a29844b55df23e3bdefbb2858f313c4df836015f05110054b6b2d3d77a123f883002a645c6a714248f409239a4efeeb8276214203602cfc1b3c00165e770b684717edf06e7a3b2eb0a4575e72719e6c23aea162a8943698f5f12d51469ce475e05820ea8843c4008bf8d3e52638c5ddbc9d8142d54432325898758d9ee669f3a3adfa620452fe44214de4469e0c022daf353e5c60febe217a1667b2e297d2c20dd2f1199d4e504d2063b67f91017426a885ee3e0bea4ff14ecd684ad9d5aa955dd99910ac0647d32725c0945b017f3c1fb87003ab4efdd766854de19c55e1705c4261ca392c19513df6d1c81564c4543586cb836bf4e5141161afdafb7ee22ccd0161940839b99d2a06f74cd0d643be1a42d79f2c879ab9a2584fa14d811d30334091c86f11375ea089eb2a3135c84719cc2d495313268ebf1a2aa2eb7b594c8b56262c55ee4678ae402d577f5a4a83910308c9740cb738b58f651bccf7b860c9269f0b75f7362e96240400de964867d367e4208afbc0d4a77938e812f88538741ea5993a184e8d0e10cf4c2cdaaecbe8d4723f2be05d026327f6be1d1c2dc4eedd28e28489a1a0e00457da34b11ec8bce72d3be179648ead9b230734ec7da0c0c68324237963660d53341b155045ecc3cc94e304654d7f5c32d04e417d7b5d3a2f8f5a9b02e7740e66bd555f96dc90d074b3b5ed42597bea8e355e78351394f1f0706a4a876d6cbe031b13077f2202625972435c8eb13c1678b54b20f133e623e6da2e0ace06fc228c994b5982fe81e938675aaa97bdb77c2af8706b9e9e99aacb17ebd62bf4f8a8d4e32797ba97876b8a6822dc06a5b55d4e6f45ff5dc3b4bd155e5ea897f0752860a7ce0ee0bc87f4393c8f6c95fc7199b3518bb2028edb780dcc309b0c4e19d8a0acc32701d407ae9560b909570469b91e272db32842f5d3d6d4d0a9670f0da6ba76693fbb785163804fd176bb1297921d55ae7719370f20edc1b58fb589f0878170593ffaba3a3e4219587865abcbfe82e0d2f17f43e99abe2ea94602a96ecd30797e5a439b2a92788bf0494934619a7629affd3268da73c19e41043d9f79dfa10dd66fec5bbc2ad03e7c448a88bc2a265de4f8a2048febfb6a2e599461d861e70d104ca02d53ae93ea857cf8957d71607e35913b034ac45b029086c3f8ebbe5de31de53ff2d410764e73e0bb30066a58bfdea689d76498cd2e706c9593cfcc548b302c431bddf784b47ae6334192cd6811e54f2c20efd895f1ab9093e49d0b84ed92b17a59a89795472f53c18b0d240353884e805e6f6dd4c1b6975fdfb2a9d665a6780dbbd3f8dca048ed609fc48d1bd63350e82c4188028bb5c8bce9a8bba61e3434bf810a67051e5ca1408a2169b0699351b5332e58d3eb5360c6f2b9dccdcf1dbda03b3cce0ced4a9993151c86c3fe968a780889f7bb5b0079eafa1465e2405e610c0b25b1910d7fba78cc3d1502a832b2dd9d1c82ae0461f5b7f0860f6e3163454e8ec84c80ee7e839713be0b42254e8dc80d67832dee8598647ca3d42ec5ddcc6ddbd3cf7810efe2d03fd379f3bc6b52f8d4e4d490d0990b4e27fe19757bb74dc89c49ce0b108b0f1dd1ba48819fac3150293fb4c1b2bf38ed2f742f66a36b783dae1a183ff0ac335e4b60c80405493150140473af712d5b48ca33d2173aeb42e607c9e9d6079dbd4d053cf1192c65044bb268f9472b48d0dde5b83534d9e5241d70207ac481e85bb52e736c1d21c036c39af9083345a958ef5a62d2067390a525ccd1b3b98cf4ba7520abc803fb8235f0961f0392ed96b1a8a0cbc6fd3d2e5202c97c0a478cd1cb9c829c21cb90c777980b2c0383468d35346953ce855bd83d7d17cb6eabf67cd79173ef08f03132d2892829866b3a24813cf5e0ee84b07f9228e29fe01f2e37deccc6071a0ddeb30025484fa55dc9152d725a1f7487da1c57aeb4ffc5131d2513840a4214776a64594258783538296a2f60e633a14591ec5c6eb3c7d3af473fa7de5aa0e49d9c34a67b8862651ad077602c4a09ceab11ea893424347ac22351e89b5f248c91e5d1651a5a909718466423510cc1818c4948a81019a9fdadc2017c2260a320471a290144fd58b66c60228c30522a0849afe34a907c328e5f52997ae3ec8e66259eb22103853ab6757014448a27da823dba738ff1d49eeba3dbcb07416d3dd7ad309e168e54517e960d558ea5454e423fffc576f8a2723111dff7ddbf65c3043828ad9d609b609f49ff6733ca5b50bcd80dfed31db5f62663b5c3c796498ca4ed2b4af79aa2ea5b3b1fa822c8d12bf96a5c3fcf1b5af9e0b2dd738df9bf6f122cca9cf9e4cb37adc97502dd041a19b055daafa2e81a950913a6bd01331ef185d6942fa459c636f5c234df9414723edfaa7b68a2825f47ea760ab347900fc40d8b1674d35e18f8c54b5b3ea0008978a9f84923aa015418aba7934582051b555311388aa8c15fde7bb05d0afeab969019d3a28266bf5f1588a708a370d7a11a2e0d92e1335e94efe20f8cbde23527ce959110d1a828cd7f00be133d5149b728f3bea2bebf425acde616ecbc98ed099262b18264ab96aecf15f08e590abd28a15b63f0369911f1aaa586cb38e7382237d987d8cdd36a425f2a2c3eb9dc64762364a85a43ff792cc989140a677c78521089d20b8d5dc116bd31e81ceb34a56502f78a21c3d7da475e8d374002b7e74d7df47e05080a11a029e3a4365ca450f32309f188bd38db019100334827e9f7240d763646264896f9b64613fa03ac5a2b9c3cae6d8b9dead204a5a39b383591bf844bd7976e13985dee0be2606eb2aa52ade0046ca275f2799940d511c2a67838bc9ae50d84e95c99238dc2e004d9595c7b3db618590def21c420591e68cfcad16fc54fe82c1567830fa2056165493159a4508b7285fbf2c954975722469e6e1b48a54d074adec8fc586ba82868df099039e98cea93a998ef552b76230a896cd730fb0b574ac70544800a0810361cd3c6886d7839f9d16894f8d49a407343f44f08511f1bea35c408186d64df01b8d9a639bdba60220ba21285433f3d9b8079f3a732e75fa8cc7a4c78706d3f1dc21dba51a61d2b9278a5724f63d30b7a26ffa1bffb07e05bcaeec13804c6070fce3383c8faa1814dc0fb8144f165bc1cdc7d86150698ee3c96e8e4b2b783271931e4f0c1a106749142eed00bb780e54d72ccb402f3bab41f8a808782bcf7821305c569be832f04b1eebf938ee5b29274195b882c25a91ebadb6d370c4a3b1c5608df8eeeeadbb4cb7a3e60584afd440175d2ba03aca9af2c87400b650c2a9ca44ba9b36e69ddc7a01c2e976808c8a317147599aa0d9c1f414308be780c2419a3d23a87053e9dec9a996bf5268f86b5f26b34a26c297e49d2129ed7a5b6e7d7a1cd0b1d32b6f3dddb2c9081ee2f4a1177fec27c18eb301f0bc8aa612885c1884858b92b5f1b332de8cabe24f1ff3b961655e44583d98eeaff0cbb04ac6ba29ce7dead231668455bdfc4f7a85a4c0f2d737810440daaf62eef0ed7a8b33d0e40f0c241807d9f385cc606de3761f9f785def07f62f53fa61e7ea2e308b3affded999e75ffcdf47c67ecea9c2197b5f52f7c1a29d2eff4d9555d48d865d9a2efb63ece44e7c4ca9324aca5ad61dcbfd56341f7b853cab68249d853d81c7c3abb6bf6bbc8709a18094c251f00e95c3a1dfd431c84665e536752b10ca552252ae8cd7c6060e0c75015e52d3064cceed11a9ce", 0x1000}, {&(0x7f00000002c0)="22c6ba73be0fc0f23c4e8f2e79c0445d4dbf36efcd93e660fd843b27fbe4ea", 0x1f, 0xb98}], 0x810020, &(0x7f0000002400)=ANY=[@ANYBLOB="646f74732c6f62eff4d73c77c9d4103100000000", @ANYRESDEC=0xee01, @ANYBLOB=',\x00']) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x4, 0x0, r3, &(0x7f0000000100)={0x4000, 0x114, 0x16}, &(0x7f0000000140)='./file0\x00', 0x18, 0x0, 0x12345}, 0x8000) 23:56:30 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00000e}]) 23:56:30 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r1, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) splice(r1, &(0x7f0000000040)=0x3, r0, &(0x7f0000000080)=0x401, 0x9, 0x2648a271dce444a0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:30 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r0 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000008, 0x2010, r0, 0x10000000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r4 = syz_io_uring_setup(0xd9d, &(0x7f0000000100), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f0000000180)) r5 = syz_io_uring_setup(0x21cb, &(0x7f0000000000), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f0000000100)) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r4, 0x6, 0x400000, r6) syz_io_uring_submit(r1, r2, &(0x7f0000000940)=@IORING_OP_SENDMSG={0x9, 0x5, 0x0, r3, 0x0, &(0x7f0000000900)={&(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0x4, 0x3, {0xa, 0x4e22, 0x64, @remote, 0x3ff}}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000040)}, {&(0x7f00000001c0)="aa6c69f983b1feb30bfcc1c30ac50dff0031d00448c6327ab4a56845eae180", 0x1f}, {&(0x7f0000000200)="e8b736f5fd0b6a77c95dbb4c5994de528e2113e2792ec4b2e0877f9352e53972db3879ff9b91ec14d2329b29553dc4bd8447cfb02029498106ccbd645c72b1f807a13401955e6240380e41799d9fabefd7801ea0ac4af466a5afcc585dbb8ea05dec8351edd4fc41c3406b59d9403b60c5511f719242535f96d7a64592ee990c6a4e68aeb449ff710d3cc0e38e3f473eb79323ccada45dac241d15bfe75e1d5e8025b028050046ec808716feb2bb9f00322d309917b0dfc2652b9808daf74de3", 0xc0}, {&(0x7f0000000380)="597472db1d1965e33c9cddddc94a0a57cff65e651f4738da8668ce4a7dfc3eb4148070a3b5dcdcb69bbb68a3853a1ef64815d41f1b504a586e546f66de336051be31affe525ab23868352f67c421341487be", 0x52}, {&(0x7f0000000400)="812d583430eb5d2e9772755fc8e166a4a719271a37f56e902f5f2175fc5aec1dd115056b5b9d3b229fa453cf35c240c0afae23aa1aa67876fe9a78468b5ebe270261b22c928de2b098b23194272aba26d103dcb7bf6d26a2e6f98787faff159b3b87bd140c61e0f9c1bb73fb1890faf5778ca567b168d9faf9a70f70581a7fc6cb14f37846146f3d84a7ec31a0f3ee3932d8", 0x92}, {&(0x7f00000004c0)="6da1112d1abb4ba975d96291dd7de5b73e8b4cd34d29bfc5a336163ca66e1383a5f2f744b0eb7e5df4ea33cbb3d1ba033f2f6f3669e20029fdc9c8f867eaeed7f8524983d255488dcc563493ce281c2db2f188ca012ad7e73113d0a8472302e35a3f547fd92ec895511e8e9691fd5575a8cd3a9541c5532a4e05bdefbc107c072a338b53b9c70bbb6fe13a9f8323f53ae162d78ab21020290856ade0dbda126a5bce0c27e76b8549ea68a9069a90a30f8a67612e348f7652f6d58884bdae0cc170e071d1ac95aac3ecdd9bae51962e9df9e001db5ff82318e714e8ced6b11251d11f6440906b9325621100c135f102da6361e09c2ea8a4cebb5bb8d40d", 0xfd}, {&(0x7f00000002c0)="f20447bea348987c945a94e8fe300b5d8b0dfefeb16ba8", 0x17}], 0x7, &(0x7f0000000640)=[{0xd0, 0x109, 0x627, "021802ccede3ec01021db25c45ac5f9fc75d66f8708c965ffa4a7de6025a3690a487aaede60d26d24df557d26e34fa5a49d3b9d6bcaaccdad8ccb224b6fa9b4287c6f478fb4050fdf9303dce70d233a33a706f37f379ce993252711845ed11bbb1906e4cf5c943784b52a82fc907ce487c5f24be17561edf5ddd679df681fa26f44823a7f7394a2e82d13a026d78a69c35483cc25b3f02c5d2764f889642bc4e18788857b6dcf1def81e9f78e3470c5e8c299184b5d56cce240b8a0f"}, {0xe8, 0x10f, 0x4, "410caf8df3be099460a1566623c1afe4df0ba852d95f7a147534038de25d198739201ef9a29cf9ef3770c336bb2c97c4b5f079842ef4f8853866a83541f2245f1243b805ec600c10eed74cfd0e7a59924a9e6adb17ac04551cb8ba4723310d6305dd736a87018eee8bd68493c0dcc693af2340ee0685ed297fa4cf22354ab33a8f831963188572dfba60e5bedd311f6a54d3a3ec27827f5b50919825a43bebc434d1d862c1a88127ed3bb97b5966b3e0b81a719d9b2b011f505b14d293b88c3f734c914f65319e2159e1580718cbee1a3c2d89c1"}, {0x68, 0x10a, 0x400, "95776ea0b1e5ca5b95e79d1e357714c659f8092ca9f231ab52c7cd6e643008d8cba6b086e315c2711dfefdd3b2e5c1d8e7ac687e991ba67519a98cbe0f2a5b3f87ee9610b308940a8bc72ad815671ac794fa91ff6a74488f"}, {0x20, 0x0, 0xa981, "53f0a9514ebd1e10c9"}, {0x50, 0x101, 0x7fff, "5efdd0af4a942401cbbcb3daacf9eb7315fff83f9bf41cd078b146a4d687086bde27a9dbf69f0daf4ded043659d29f4a87bed848ea91b577b8b4"}], 0x290}, 0x0, 0x4004050, 0x1, {0x0, r6}}, 0x2) 23:56:30 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x7403}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:30 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x4, 0x1, 0x0, 0x81, 0x0, 0x5, 0x809c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, @perf_bp={&(0x7f0000000040), 0x8}, 0x15020, 0x6, 0x40, 0x0, 0x1ff, 0x4, 0x1f, 0x0, 0xc4, 0x0, 0x401}, 0x0, 0x6, r1, 0x0) 23:56:30 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000010}]) 23:56:30 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x8a00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:31 executing program 0: r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, 0x0, 0x800, 0x70bd28, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0x4}}, ["", "", ""]}, 0x24}}, 0x894) syz_io_uring_setup(0x6b64, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2}, &(0x7f00006d6000/0x4000)=nil, &(0x7f00006d7000/0x2000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x10b) flock(r1, 0x2) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r1) sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000400)={0x58, r2, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x800}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @private=0xa010100}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x24000004}, 0x20000040) sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="a0000000", @ANYRES16=r2, @ANYBLOB="000126bd7000ff00000000008400038014000600fe80000000000000000000000000003d1400020076657468315f746f5f68737200000000080001000000000006000400581d000014000600fc00000000000000000000000000000108000100010000000500080002000000060007004e20000014000600000000000000000000000000000000000800050000000000"], 0xa0}, 0x1, 0x0, 0x0, 0x20000051}, 0x800) [ 2947.429144][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.438076][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2947.479163][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.487542][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2947.499320][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.507615][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2947.651131][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.659964][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2947.675183][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.683904][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2947.696286][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.704575][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2947.723086][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.731603][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2947.753851][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.762083][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2947.774613][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.783014][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2947.838863][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.847584][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2947.861388][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.870638][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2947.882518][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.891211][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2947.912379][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.920842][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2947.933061][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.941294][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2947.953271][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.961859][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2947.974191][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2947.982618][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2947.995072][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2948.003387][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2948.015751][T22177] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2948.024226][T22177] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:32 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:32 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xfeff}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:32 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/stat\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000200)={{{@in=@remote, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f00000000c0)=0xe8) sendmsg$nl_netfilter(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0x2f0, 0x2, 0x4, 0x401, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x1}, [@typed={0x8, 0x4f, 0x0, 0x0, @u32=0x7ff}, @generic="5c18b351c394926df8478202091e4453663812f0f9721b593ba34d4d2d293f5568deaa51080b49a74c5fc7066adb351fbe3eda0e42e4961431d022b4720d6d88edb2e6cb160c5930a71e7d744e4cc320cf9e55612870f45370373ee27764b1bc2f8ee712332e2063775903ac462dd1912ed4ef638fc6cbaa776cf045995dd91f01e9ba8b2adda8b83fcf65d5275f6bedc809b0d88b104f1b860f1193eb6207e9c5d9ca759e85dd4b7057629f573aadfa34bf1c2c115f358bb299a3bb0ff8332f1173f548f5d9dd64cf5f0596590be2bb0ad326e9ae247b02256079bac716521698d33a9459b8ae865562b0abc408d69d7b4558549743c194b813", @typed={0x8, 0x1f, 0x0, 0x0, @uid=r2}, @generic="5ae9a018ed389d806d26cc050899ad7074e4142969679c7f04f9ae579ac2e2d79b26811e4982c009532c172e8e70f8c7f31f0bfbdcb68ca37fd3e6958c25e7a3a9920e9e6601c1e123e517323f560dc04799dd32ae23d9ee526682deb4cde1b336162044aa613a2b1b5c2657acd08b01abcec117175c4ca8ae", @nested={0x156, 0x14, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @fd=r0}, @generic="11a903135c1683b3789f4edf592075e85b33bb80499e2f6bc8fcaf7096855aefb0bc92476bac8b462f73a6ea7ca337ba6348a266ae9b5638dd1c16c3c7930702537f77fe594229e9cc876ad82cdb98f4fdd8e51ae8960e45c71779a49ce8813b893d1a752a679e82e688dba6f80dd49cb3dfff3ee30b097389d359e52992ec305cbdde7e882088c9b602efe322b0daca04b8f9dd823d596943b774662d67756f014e6f83e5ee9cba8604ccf9aacd0557f569de671366538dd4a7eaacc8d762059e13b1da9601706ee2a45bed71d9339a8cce2af75daf", @typed={0x71, 0x4b, 0x0, 0x0, @binary="fff23a887df23f74b83c4a05c94217beba6e60d3d5c3ada07fb31cdcf4ed4664ba8d4c8cc7656c90deb1a27464f9bb37417d79fb0d7c4b940d2bb1a3bc4a964b471549a7d8b84148cd70a45bd96a47bc251465ca159548cd49e89100c414202d77feb6dc48eeaf0225cf7dccdb"}]}]}, 0x2f0}, 0x1, 0x0, 0x0, 0x800}, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:32 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000012}]) 23:56:32 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x200000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:32 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000040)) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) r1 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r1, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000140)={0x6, &(0x7f0000000100)=[{0x80, 0x7, 0x1, 0x7}, {0x54a, 0x26, 0x8, 0x80}, {0x401, 0xff, 0x6, 0x4}, {0x1, 0x8a, 0x87, 0x4}, {0x2, 0x4, 0x0, 0x9}, {0x5, 0x81, 0x1e}]}, 0x10) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x181, 0x0, r0}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:32 executing program 0: ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0x80089203, &(0x7f0000000100)) r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)) syz_io_uring_setup(0x5d4, &(0x7f0000000240)={0x0, 0xbf8, 0x20, 0x1, 0x3d9}, &(0x7f00006d6000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000040), &(0x7f00000001c0)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_WRITE_FIXED={0x5, 0x2, 0x4004, @fd=r0, 0x1, 0x80, 0x9, 0x10, 0x1}, 0x9) 23:56:32 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xfffe}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:32 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000063}]) 23:56:32 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x5fa1, 0x0, 0x3}, &(0x7f00003b2000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)=0x0) r3 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_setup(0x79ec, &(0x7f0000000240)={0x0, 0x8179, 0x20, 0x1, 0x288, 0x0, r3}, &(0x7f00003b2000/0x2000)=nil, &(0x7f00006d7000/0x3000)=nil, &(0x7f00000002c0), &(0x7f0000000380)=0x0) clock_gettime(0x0, &(0x7f00000003c0)={0x0, 0x0}) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r4, r7, &(0x7f0000000440)=@IORING_OP_TIMEOUT={0xb, 0x4, 0x0, 0x0, 0x2, &(0x7f0000000400)={r8, r9+60000000}, 0x1, 0x1, 0x1, {0x0, r10}}, 0x10000) r11 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) io_uring_enter(r11, 0x6693, 0x7d34, 0x0, &(0x7f0000000200)={[0x88]}, 0x8) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r6, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000040)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd=r0, 0x9, 0x2, 0xd31, 0x4}, 0x3) 23:56:32 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x100, 0x40) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r2, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) r3 = creat(&(0x7f0000000040)='./file0\x00', 0xa) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800000, 0x10, r3, 0x4000) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c01}, 0x0, 0x8, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000}, 0xffffffffffffffff, 0xe, r1, 0x1) 23:56:32 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x40000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2949.413911][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.422882][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2949.465083][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.473684][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2949.485683][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.493900][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2949.632142][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.641290][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2949.656269][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.664642][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2949.676356][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.684808][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2949.703895][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.711907][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2949.734192][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.742286][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2949.754454][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.762909][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2949.808986][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.818559][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2949.832215][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.842717][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2949.854377][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.863232][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2949.886578][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.894947][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2949.907553][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.915668][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2949.927282][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.935624][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2949.947893][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.956170][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2949.968818][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.976855][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2949.988683][T22226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2949.996738][T22226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:34 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xd00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:34 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x40080, 0x4) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:34 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x1000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:34 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000082}]) 23:56:34 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:34 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r0 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r6, 0x0, 0x0, 0x0, 0x40800}, 0x0) r7 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x121800, 0x0) r8 = syz_io_uring_setup(0xd9d, &(0x7f0000000100), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f0000000180)) r9 = syz_io_uring_setup(0x21cb, &(0x7f0000000000), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f0000000100)) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r9, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r8, 0x6, 0x400000, r10) syz_io_uring_submit(r1, r5, &(0x7f0000000100)=@IORING_OP_SPLICE={0x1e, 0x1, 0x0, @fd_index=0x3, 0x69, {0x0, r7}, 0x938, 0xae25f73416130c98, 0x0, {0x0, r10, r0}}, 0x5) 23:56:34 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000040)={0xff, 0x0, 0x9}) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:34 executing program 0: r0 = socket(0x4, 0xa, 0x6322) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000040)={{}, 0x2, 0x1, 0x3}) syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:34 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x2000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:34 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a0000ef}]) 23:56:34 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:34 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_SEND={0x1a, 0x3, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)="51721dcf8dde4b324e77efd5cb1df3d978b9b1539e9c8dbba5562e4dd1b8d3df3b5567b7", 0x24, 0x0, 0x0, {0x0, r1}}, 0x4) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2951.041776][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.049976][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2951.090381][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.099352][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2951.111778][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.120170][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2951.264095][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.277665][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2951.292360][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.301316][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2951.313648][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.321971][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2951.340241][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.348422][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2951.371161][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.379834][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2951.392468][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.401521][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2951.450487][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.459062][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2951.472486][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.480865][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2951.493372][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.502303][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2951.523568][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.535616][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2951.548609][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.557892][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2951.569964][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.579912][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2951.592888][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.601123][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2951.614407][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.622926][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2951.636613][T22270] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2951.644892][T22270] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:35 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xe00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:35 executing program 0: syz_io_uring_setup(0x7dd5, &(0x7f00000000c0)={0x0, 0x1de6, 0x2, 0x0, 0x12d}, &(0x7f00006d6000/0x1000)=nil, &(0x7f00006d6000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:35 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x2040000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:35 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a0000f6}]) 23:56:35 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1000001000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:35 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x30000, 0x0) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) preadv(r2, &(0x7f0000000480)=[{&(0x7f0000000080)}, {&(0x7f00000000c0)=""/124, 0x7c}, {&(0x7f0000000200)=""/171, 0xab}, {&(0x7f00000002c0)=""/126, 0x7e}, {&(0x7f0000000140)=""/31, 0x1f}, {&(0x7f0000000340)=""/114, 0x72}, {&(0x7f00000003c0)=""/51, 0x33}, {&(0x7f0000000400)=""/69, 0x45}], 0x8, 0x6, 0x3fa) r3 = perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r1, &(0x7f0000000680)=[{&(0x7f0000000080)=""/26, 0x1a}, {&(0x7f0000000500)=""/71, 0x47}, {&(0x7f0000000580)=""/14, 0xe}, {&(0x7f00000005c0)=""/71, 0x47}, {&(0x7f0000000640)}], 0x5, 0x2, 0xa6f) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, r4) 23:56:35 executing program 0: ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(0xffffffffffffffff, 0x80489439, &(0x7f0000000100)) copy_file_range(0xffffffffffffffff, &(0x7f0000000040)=0x7, 0xffffffffffffffff, &(0x7f00000001c0)=0x2, 0x0, 0x0) syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x104, &(0x7f0000000200)=0x6, 0x0, 0x4) 23:56:36 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) ptrace$cont(0x9, 0x0, 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1e) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) clone3(&(0x7f0000000340)={0x830c3400, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000200), {0x18}, &(0x7f0000000240)=""/34, 0x22, &(0x7f0000000280)=""/94, &(0x7f0000000300)=[0x0, 0x0, r1, 0x0], 0x4, {r2}}, 0x58) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$EVIOCGMASK(r3, 0x80104592, &(0x7f00000000c0)={0x16, 0x4c, &(0x7f0000000040)="a60762439a3c7c8cc4d8dc4991dcdc39084890bef5cd41343d4ef86cfa771a01b82e28f10de213b4d9cceea889be659140ce365667f6f7f6b6b2b8f4e251c5b5af8c02e9de1974d699941f0e"}) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:36 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x6040000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:36 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f00000014c0)=[{&(0x7f0000000040)=""/107, 0x6b}, {&(0x7f0000000200)=""/240, 0xf0}, {&(0x7f0000000300)=""/237, 0xed}, {&(0x7f00000000c0)=""/65, 0x41}, {&(0x7f0000000140)=""/14, 0xe}, {&(0x7f0000000400)=""/181, 0xb5}, {&(0x7f00000004c0)=""/4096, 0x1000}], 0x7, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:36 executing program 0: ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000240)=""/176) syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)=0x0) syz_io_uring_setup(0x5192, &(0x7f0000000100)={0x0, 0x1b82, 0x1, 0x1, 0x2cc}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000040)=0x0, &(0x7f00000001c0)) syz_io_uring_submit(r1, r0, &(0x7f0000000200)=@IORING_OP_FALLOCATE={0x11, 0x5, 0x0, @fd_index=0x7, 0x2, 0x0, 0x8}, 0x9) 23:56:36 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a0000fe}]) [ 2952.648004][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2952.656374][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2952.695788][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2952.704874][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2952.716640][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2952.725117][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2952.866962][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2952.876174][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2952.891954][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2952.900393][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2952.914341][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2952.925091][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2952.943494][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2952.952946][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2952.976608][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2952.985860][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2953.000247][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2953.008935][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2953.055651][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2953.063662][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2953.077922][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2953.085936][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2953.098320][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2953.106819][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2953.128399][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2953.136572][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2953.149713][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2953.158682][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2953.171812][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2953.180241][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2953.193144][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2953.201171][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2953.213930][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2953.222156][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2953.234237][T22316] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2953.242375][T22316] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:37 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) recvmsg(r4, &(0x7f0000000580)={&(0x7f00000003c0)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000440)=""/239, 0xef}], 0x1}, 0x21) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x8, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@uname={'uname', 0x3d, '{)!'}}, {@loose}, {@afid={'afid', 0x3d, 0x400}}, {@access_any}, {@loose}, {@privport}, {@access_any}, {@dfltgid={'dfltgid', 0x3d, r3}}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}]}}) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$BTRFS_IOC_RESIZE(0xffffffffffffffff, 0x50009403, &(0x7f0000000040)={{r0}, {@void, @actul_num={@val=0x2b, 0xf00, 0x54}}}) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) fsetxattr$security_capability(r0, &(0x7f0000000140), &(0x7f0000000380)=@v2={0x2000000, [{0xad7a, 0x3}, {0x8, 0x1b99}]}, 0x14, 0x4) 23:56:37 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:37 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000204}]) 23:56:37 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x7000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:37 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x5fa1, 0x0, 0x3}, &(0x7f00003b2000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)=0x0) r3 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_setup(0x79ec, &(0x7f0000000240)={0x0, 0x8179, 0x20, 0x1, 0x288, 0x0, r3}, &(0x7f00003b2000/0x2000)=nil, &(0x7f00006d7000/0x3000)=nil, &(0x7f00000002c0), &(0x7f0000000380)=0x0) clock_gettime(0x0, &(0x7f00000003c0)={0x0, 0x0}) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r4, r7, &(0x7f0000000440)=@IORING_OP_TIMEOUT={0xb, 0x4, 0x0, 0x0, 0x2, &(0x7f0000000400)={r8, r9+60000000}, 0x1, 0x1, 0x1, {0x0, r10}}, 0x10000) r11 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) io_uring_enter(r11, 0x6693, 0x7d34, 0x0, &(0x7f0000000200)={[0x88]}, 0x8) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r6, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000040)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x0, @fd=r0, 0x9, 0x2, 0xd31, 0x4}, 0x3) 23:56:37 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:37 executing program 0: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x3f00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:37 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000281}]) 23:56:37 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x8000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:37 executing program 0: fcntl$setpipe(0xffffffffffffffff, 0x407, 0x3) r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$TCSETSF2(r1, 0x402c542d, &(0x7f0000000040)={0x3, 0x9, 0x6, 0x3, 0x8, "dc278fa4112102e4c875f33f907e8fcdd8f960", 0xf6e7, 0x4}) r2 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x4}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0x40800}, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f00005e5000/0x4000)=nil, 0x4000, 0x5000000, 0x12, r0, 0x10000000) r7 = accept$inet(r1, &(0x7f0000000100)={0x2, 0x0, @remote}, &(0x7f0000000140)=0x10) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000380)=@IORING_OP_WRITEV={0x2, 0x2, 0x2007, @fd=r7, 0x4, &(0x7f00000002c0)=[{&(0x7f00000001c0)="9ece170ef9af445e33e0a55e95b460d388c1b76a8a2965c4f62ae3da8be6fd46e625", 0x22}, {&(0x7f0000000200)="0d971466fd9824db5a51ba89f8266a3a92", 0x11}, {&(0x7f0000000240)="d365ebee9d15d895713a7a76ce69c6a74ac6513985f78ae36ce4603d1d404eeb408d903444cb6ab6ba7334c88abeeba7bb2cab01347962b4b1552a46c24cc61ad6a9ad8be3f8e8d2", 0x48}], 0x3, 0x5, 0x1, {0x0, r8}}, 0x4) r9 = signalfd4(r2, &(0x7f00000003c0)={[0x34]}, 0x8, 0x800) io_uring_setup(0x3dd3, &(0x7f0000000400)={0x0, 0xf355, 0x10, 0x1, 0x6, 0x0, r9}) 23:56:37 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x9000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:37 executing program 0: fcntl$setpipe(0xffffffffffffffff, 0x407, 0x3) r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$TCSETSF2(r1, 0x402c542d, &(0x7f0000000040)={0x3, 0x9, 0x6, 0x3, 0x8, "dc278fa4112102e4c875f33f907e8fcdd8f960", 0xf6e7, 0x4}) r2 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x4}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0x40800}, 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f00005e5000/0x4000)=nil, 0x4000, 0x5000000, 0x12, r0, 0x10000000) r7 = accept$inet(r1, &(0x7f0000000100)={0x2, 0x0, @remote}, &(0x7f0000000140)=0x10) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000380)=@IORING_OP_WRITEV={0x2, 0x2, 0x2007, @fd=r7, 0x4, &(0x7f00000002c0)=[{&(0x7f00000001c0)="9ece170ef9af445e33e0a55e95b460d388c1b76a8a2965c4f62ae3da8be6fd46e625", 0x22}, {&(0x7f0000000200)="0d971466fd9824db5a51ba89f8266a3a92", 0x11}, {&(0x7f0000000240)="d365ebee9d15d895713a7a76ce69c6a74ac6513985f78ae36ce4603d1d404eeb408d903444cb6ab6ba7334c88abeeba7bb2cab01347962b4b1552a46c24cc61ad6a9ad8be3f8e8d2", 0x48}], 0x3, 0x5, 0x1, {0x0, r8}}, 0x4) r9 = signalfd4(r2, &(0x7f00000003c0)={[0x34]}, 0x8, 0x800) io_uring_setup(0x3dd3, &(0x7f0000000400)={0x0, 0xf355, 0x10, 0x1, 0x6, 0x0, r9}) [ 2954.049321][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.058253][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2954.076031][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.085228][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2954.097723][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.106242][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2954.149604][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.158901][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2954.171857][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.180035][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2954.192561][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.200680][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2954.214294][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.222602][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2954.236405][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 23:56:38 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000300}]) [ 2954.244562][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2954.257325][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.265680][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2954.325609][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.334295][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2954.347597][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.356012][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2954.369473][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.378041][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2954.397599][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.406095][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2954.418880][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.427287][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2954.441318][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.450040][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2954.462744][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.471554][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2954.484729][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.493161][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2954.506198][T22354] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2954.514635][T22354] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:38 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:38 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:38 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xa000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:38 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_setup(0x6b6a, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3, 0x231, 0x0, r0}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000061000/0x2000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:38 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:38 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a0003e8}]) 23:56:38 executing program 0: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x9000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:38 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x300000c, 0x1010, r0, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x3, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000100)="c84e714f559ffffa6b3feceb104e738027644c8858da56d04131649e2e354f775b4497f2443d6870a15fc1a5e69f0f9cfbacf3df706c90578fabc6beb0928ea94bd716f3580d20c3d2eb8436e79b7192615f8f3ff5e077fcbeb1897b082e31b26fdbdd32ea5f68afd52c9b9abba8b82f61b379edaf1c8b4e", 0x78, 0x40010001, 0x1}, 0x1ff) 23:56:38 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xf000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:38 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0xadb16000) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(0xffffffffffffffff, &(0x7f00000023c0), 0x0, 0x5, 0x200) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f00004f4000/0x1000)=nil, 0x1000, 0x1000004, 0x40010, r1, 0xcd5b0000) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40100, 0x0) perf_event_open(&(0x7f0000000180)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x120f, 0x0, 0x0, 0x7}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x3) preadv(r0, &(0x7f0000002340)=[{&(0x7f0000000040)=""/3, 0x3}, {&(0x7f0000000080)=""/212, 0xd4}, {&(0x7f0000000200)=""/4096, 0x1000}, {&(0x7f0000001200)=""/250, 0xfa}, {&(0x7f0000001300)=""/26, 0x1a}, {&(0x7f0000001340)=""/4096, 0x1000}], 0x6, 0x1ff, 0x1) 23:56:38 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000402}]) 23:56:39 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_io_uring_setup(0x34b7, &(0x7f0000000100)={0x0, 0xdd4c, 0x8, 0x1, 0x1f1}, &(0x7f00003b2000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000040), &(0x7f00000001c0)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) io_uring_enter(r0, 0x5b2c, 0x89e5, 0x1, &(0x7f0000000240)={[0x4000000000e586]}, 0x8) [ 2955.549491][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2955.558043][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2955.598708][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2955.607398][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2955.619262][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2955.628535][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2955.768576][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2955.778462][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2955.795922][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2955.805168][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2955.819624][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2955.829202][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2955.854105][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2955.863304][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2955.885895][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2955.895483][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2955.910166][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2955.920204][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2955.970345][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2955.980648][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2955.995521][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2956.004264][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2956.018401][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2956.026969][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2956.051046][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2956.059630][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2956.072578][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2956.081395][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2956.093590][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2956.102263][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2956.115512][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2956.124677][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2956.137919][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2956.148628][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2956.161747][T22396] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2956.171507][T22396] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:40 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:40 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_io_uring_setup(0x34b7, &(0x7f0000000100)={0x0, 0xdd4c, 0x8, 0x1, 0x1f1}, &(0x7f00003b2000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000040), &(0x7f00000001c0)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) io_uring_enter(r0, 0x5b2c, 0x89e5, 0x1, &(0x7f0000000240)={[0x4000000000e586]}, 0x8) 23:56:40 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x20000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:40 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000406}]) 23:56:40 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:40 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00001f0000), 0x1000002, 0x0) r2 = dup(r1) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/74, 0x4a}], 0x1, 0x0, 0x4) r3 = open(&(0x7f0000000100)='./bus\x00', 0x14d042, 0x0) ftruncate(r3, 0xee72) sendfile(r2, r3, 0x0, 0x8000fffffffe) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, &(0x7f0000000080)="41c5e4cc5d8ff1aba6c8b24c649a685c55383da9ddba076fa003733417f9d1c9e830b59b8749c1da85c36c1c3d8bb822df8f430071dfbecf64cc767781187a6497f212") open$dir(&(0x7f00000006c0)='./bus/file0\x00', 0x0, 0xa4) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x4, 0x80, 0x0, 0x9, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$KDFONTOP_SET_DEF(r4, 0x4b72, &(0x7f0000000680)={0x2, 0x0, 0x6, 0xc, 0x13c, &(0x7f0000000280)="f26fa8008de241f56bb8ac6115d37e96faa9fee2f7b877d7a467ac8720b48924188671adfd284831d1e8ee8348bf5d6e04e5d282c1ead496026fe118220866867a2e73ed26aeeafb0e34877d5f156ec4cfb63f072ebd18b93bf2acd7433335342630851a6b540b7840a2159d58ee5409a92e9e2be9d6da2f92eddc1a2d2f892c492288435f1008df94abde45dfec9c318629145119c22732789310ff728bc4fdfab6b6266d0ac58eefabb704502bdc6abc9acbba627aa9ccc9f6fff9bb8b0d84c9619e30b347ffcf88d478c54ca8db9be940a90d00b88fabcb9cc636c8cbeddefad6b4a61a857d67d9eb8d38f6ebab4e09b6c9c88247b97738c2e973890820de1908f0ae734d72ae05c4fcb1bad5d1b46703d4e46260a4897bf327ba6942d0ef88698d18c30bf9147dad0942bac4f6e365fd7a3987e5cc16b3543ead74ba54a3c6dd7c24b67e243a15b56d53b2962cd5b4f2b376c0efe80db27b632d0552beff0a60b5f495922f9818a6261b17ea825bc48c9b3c6b58273a0a90305df5269224fa0009e466f6dd88e58b13a2ec9a4bcfbc52d14c03b288978bc8cfa4de9237b033c93290c19cdc573860f953c97852ed46c5e61c2d070d120a23723bd452353a4ace9ac123e76295a277c9023779054da8c3d7b332cdb5ebdd19cc9f4a785ee6c71ddabe72439403b2ba0db3fa694cfeb3466c4fb1989892b5365fba7ac5f8b23b579a02c5240b11aa8764c28ab8a1b48be44ecd1634ea573fc8abf063c0a490267ce3ff73f007242473de25e80a9524d2776bd43b99589f3e8057fc49686cdc64b59a5b445bc9cda20f5a4a3e1adc8619fdc94ad44f6a9fc1ebae876780651f455df3405802e454c55fdc780084e9b8a90942acac0d6ad300c52d47d0a00f9be2353a9964b389f922f914791c53949609cc82cacf3a8cdff7c7a435aa5221c5fd3040f8fbeeae96cc13462eb94d57076772d0604eda561849e5373d86ffac791eccdf5271397f4db520c1cb29295cde69e8f98497fe16f5827f91f732c0a54f70310636c43bad4996bb5fac8be6a9e40fdc6ef4809a760c97c2ba7f3ebf6646b5696dd9597727883d6d3aafe6572fb44d0611fc7c6ef0d508a980204d973d6a152a1402141504732cb88ef7993f5b8ed0d089e4b7039bd3c0eaa9a6f1d6e98ffa861e8559b901328accb84ee7f5b675932d7e1da3fed2018f8b83e4535ff8f68e0aac3c9847fd6f64bd9c695d3934cd23194156a1fc8b6047ed1a46bad1747121372106b8a521e8810907e80bc78474995c6fc17e30ca3d4d61a6883371f65b7485f13949f375a295641b56ccd728d5b8b1a601e7e3fb61112f404b81774d61671c6666f37e726fbe70004f27095b7105b9084aab99738adee67db7f2bb4d56de72cd607b7586fc8095217e917d9062a2417d0ae94cd3391165603d3ec396dc"}) 23:56:40 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000040)=0x80000001, 0x0, 0x4) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r0, r1, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0xc, &(0x7f0000000100), 0x0, 0x4) 23:56:40 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x21000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:40 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) write$binfmt_script(r1, &(0x7f0000000440)={'#! ', './file0', [], 0xa, "daac35053a08eb031a193c9598ace914de16e7366dee91a7a69fe0be20f3f421eeba5151e3f4e5728426271feefa6520ce50d7971003af790256975e9358c6753bc4cbc000dc5e09b74f44e00dcd5e14222d7335acd409c0178cdbf61c7f1079bbb2c10cdd97e1a4d4fdf4794fd698ce7b8489da4ca28caa44d7660b227b916e00e27cd0b1f13487ca72cc8a553fe03cd7ea7095e4e1074ffd5e0d2a02a04fd8fdf663273b867f6a60544c4d30714017"}, 0xbb) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000707000/0x2000)=nil, 0x2000, 0x3000007, 0x30, r1, 0xc3b82000) openat$incfs(r2, &(0x7f0000000040)='.log\x00', 0x24c40, 0x80) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) preadv(r3, &(0x7f00000003c0)=[{&(0x7f0000000080)=""/32, 0x20}, {&(0x7f00000000c0)=""/143, 0x8f}, {&(0x7f0000000200)=""/139, 0x8b}, {&(0x7f00000002c0)=""/149, 0x95}, {&(0x7f0000000380)=""/42, 0x2a}], 0x5, 0x3, 0x1ff) 23:56:40 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000408}]) 23:56:40 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r0 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)=0x0) r2 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0x40800}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000057c0)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000380)=""/219, 0xdb}, {&(0x7f0000000480)=""/181, 0xb5}, {&(0x7f0000000040)=""/52, 0x34}, {&(0x7f0000000100)=""/127, 0x7f}, {&(0x7f0000000280)=""/91, 0x5b}], 0x6, &(0x7f00000005c0)=""/31, 0x1f}, 0x1ff}, {{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000600)=""/221, 0xdd}, {&(0x7f0000000700)=""/30, 0x1e}, {&(0x7f0000000740)=""/4096, 0x1000}], 0x3, &(0x7f0000001780)=""/113, 0x71}, 0x9}, {{&(0x7f0000001800)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f0000001900)=[{&(0x7f0000001880)=""/116, 0x74}], 0x1}, 0x2}, {{&(0x7f0000001940)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f0000002bc0)=[{&(0x7f00000019c0)=""/251, 0xfb}, {&(0x7f0000001ac0)=""/32, 0x20}, {&(0x7f0000001b00)=""/156, 0x9c}, {&(0x7f0000001bc0)=""/4096, 0x1000}], 0x4, &(0x7f0000002c00)=""/236, 0xec}, 0xff}, {{&(0x7f0000002d00)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000004140)=[{&(0x7f0000002d80)=""/92, 0x5c}, {&(0x7f0000002e00)=""/25, 0x19}, {&(0x7f0000002e40)=""/133, 0x85}, {&(0x7f0000002f00)=""/78, 0x4e}, {&(0x7f0000002f80)=""/160, 0xa0}, {&(0x7f0000003040)=""/61, 0x3d}, {&(0x7f0000003080)=""/192, 0xc0}, {&(0x7f0000003140)=""/4096, 0x1000}], 0x8, &(0x7f00000041c0)=""/4, 0x4}, 0x421}, {{&(0x7f0000004200)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f00000042c0)=[{&(0x7f0000004280)=""/5, 0x5}], 0x1, &(0x7f0000004300)=""/20, 0x14}, 0x37c1eca4}, {{0x0, 0x0, &(0x7f0000005700)=[{&(0x7f0000004340)=""/39, 0x27}, {&(0x7f0000004380)=""/18, 0x12}, {&(0x7f00000043c0)=""/233, 0xe9}, {&(0x7f00000044c0)=""/66, 0x42}, {&(0x7f0000004540)=""/4096, 0x1000}, {&(0x7f0000005540)=""/168, 0xa8}, {&(0x7f0000005600)=""/20, 0x14}, {&(0x7f0000005640)=""/132, 0x84}], 0x8, &(0x7f0000005780)}, 0x1}], 0x7, 0x40000000, &(0x7f0000005980)={0x0, 0x3938700}) syz_io_uring_submit(r3, r1, &(0x7f0000005a00)=@IORING_OP_ACCEPT={0xd, 0x4, 0x0, r6, &(0x7f00000059c0), 0x0, 0x0, 0x80800, 0x1}, 0x1000) r7 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r8, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r7, &(0x7f0000000000), 0x10000}]) r9 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000005ac0)='devices.allow\x00', 0x2, 0x0) r10 = dup2(r2, r5) r11 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r11, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) r12 = dup2(r6, r2) r13 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r13, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) r14 = openat(0xffffffffffffffff, &(0x7f0000005e00)='./file0\x00', 0x240080, 0x2e4) io_submit(r8, 0x5, &(0x7f0000005e80)=[&(0x7f0000005780)={0x0, 0x0, 0x0, 0x0, 0x6, 0xffffffffffffffff, &(0x7f0000005a40)="324e50b697b3737ac6fab67d54f89d63fc5e52e0fbc4f1a1dcfb9fe1c81345e08b381bfb37891d9f112aa950e45fab69b936f07af74c82301985174fe9b5c6fe32b53304d0c1e54e549d874278917f5b92c9d470d0d7f79fc8204649", 0x5c, 0x7, 0x0, 0x3}, &(0x7f0000005b40)={0x0, 0x0, 0x0, 0x8, 0x2, r9, &(0x7f0000005b00)="03ec802c270da5ac4bec804eca57ed9999257da4a512523e72b1f8929f47e96440f6c92585234e8a89abd7dc24", 0x2d, 0xe6bb, 0x0, 0x1, r10}, &(0x7f0000005c00)={0x0, 0x0, 0x0, 0x3, 0x4, r11, &(0x7f0000005b80)="4e7660442812a0376de8fd2376acb2c54ecc13388ba5972cd9f796086a1df387aa3ce2ad8b2db17f0418d309c2762c17e5715c124374fcda95333dadd936fd37e2ff9e460cf081779afc85dae32a868bebe2f7e2a3c43c5a73a07310e266a8ed9f5bb66167e6d13113d7457a462295f455c56d968fe8479320bd", 0x7a, 0x4, 0x0, 0x1, r12}, &(0x7f0000005d00)={0x0, 0x0, 0x0, 0x6, 0x5, r13, &(0x7f0000005c40)="bc665a1f7e049cf07c4dc79325b99a790361b271ab44aa334e3124c4c2e9e03de77a4f8406d6c5bb98c01e9b2ec88e9b0abe8814e422b49d5e86aa86f674a9e2a640d7210e67760f613cfca63346bc6dbcfbe43c259618a0db259e3cd973f143dacf9bfc4587593b1dfa00b7b76e022b4a4cc52fcdd88d20c9d902cc65a8dce6d455", 0x82, 0x7, 0x0, 0x2}, &(0x7f0000005e40)={0x0, 0x0, 0x0, 0x6, 0x4, r0, &(0x7f0000005d40)="ebdd1fd72bd971077a46a8edaec17120819477331fe81858bb36a99c3e3dc54af53383f7d2d4218002d36a8fd7341d7ff235da3961674d68b9162facba856a35ba844256b8d5348492450e09990f3198170cffded268596db26cac6c194d348965f8c71e523e838a34090263838bd4fa1afec8f5ce432441acc40eafb8920f75bf526e4f4a", 0x85, 0x3, 0x0, 0x0, r14}]) 23:56:40 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x3f000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:40 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001300)={{{@in=@initdev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6}}, &(0x7f0000001400)=0xe8) r2 = socket$unix(0x1, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r3) syz_mount_image$iso9660(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0xff6, 0x1, &(0x7f0000000140)=[{&(0x7f0000000100)="0c7e8ecb150b785f3a0aefc2e8f3af6d7c91f4a0d3ba7aebdbe0567f686697d51174b5e6", 0x24, 0x40}], 0x210a0, &(0x7f0000001440)={[{@session={'session', 0x3d, 0xe}}, {@overriderock}, {@map_normal}, {@dmode={'dmode', 0x3d, 0x4}}, {@gid={'gid', 0x3d, 0xee00}}, {@hide}, {@map_acorn}, {@mode={'mode', 0x3d, 0x2}}, {@map_acorn}], [{@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@seclabel}, {@euid_gt={'euid>', r1}}, {@fsmagic={'fsmagic', 0x3d, 0xffffffff}}, {@subj_role={'subj_role', 0x3d, '}.'}}, {@uid_eq={'uid', 0x3d, r3}}]}) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x2) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) vmsplice(r4, &(0x7f0000000400)=[{&(0x7f0000000200)="1e452a339ddc1c478a7c8c668312973141fa8b5c12cfb8849df4d6b25cf5dff98d37aba1276244b6dca19ebe933e39e69e95f2d7db2ed0f10250178491c3229d4856b320766313d84aa2b4d4a71d98058cf6433f8f3e1a57ab4a62b747a3b7f8278fe3b1b95ffe9d49fa039ab2b6f33f5c38617261e883bdbc5340651e87f5c56e2d77699511f9455dea2d15883c4d0636903da669cf4244e48f", 0x9a}, {&(0x7f00000002c0)="c41093a573c2aba81dc605d648b00ea4da704afc4eae959fedd429415d695f7d9f122d84272b80412084869e25634c591ec339d90e586f5f7c6670a59cf62b87cfcd077db5c0c97153f0b8d29176cebeca1ff95d7c79f0d98365d6971364edf00cef5793a5f05482b1e0b1cce2c7305744bb1a8c375b8d4c2c14466544aa3362ea3dfa9e599087e0efae53", 0x8b}, {&(0x7f0000000380)="0e26d45aa200d8dde0ffff755d632cd6c06bfe50f5c8264aa56c8ded16b2d110241650de5a5816c740fc2a563dacdfa26f35a44a75c30d59518701d6356add7d1be80ea42c25d11600bc87ea3c236b65d5f7cde9dfc6331cc13bf3902619bff536157f6e46f47f6399c281efd6147399a01fae2cc9c4bab8cdf6a4da216dfd", 0x7f}], 0x3, 0x5) [ 2956.950909][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2956.959435][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2956.978596][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2956.987536][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2956.999736][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.009889][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2957.043958][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.053013][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2957.066515][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.074937][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2957.087938][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.096417][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2957.111832][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.121186][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2957.134725][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.144337][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2957.156553][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.165742][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2957.208127][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.216721][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2957.229813][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.238449][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2957.250048][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.258389][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2957.274253][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.282771][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2957.295189][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.303615][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2957.315716][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.323905][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2957.336200][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.344558][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2957.357039][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.365778][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2957.379038][T22433] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2957.387167][T22433] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:41 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:41 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000500}]) 23:56:41 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x40000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:41 executing program 0: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x8a}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:41 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) umount2(&(0x7f00000000c0)='./file0\x00', 0xc) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0xfc, 0x1f, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffe}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000040), &(0x7f0000000080), 0x2, 0x6) 23:56:41 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x10000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:41 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x40800}, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000495000/0x2000)=nil, 0x2000, 0x3000000, 0x20010, r0, 0x10000000) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r5, 0x0) preadv(r5, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000040)=@IORING_OP_WRITE_FIXED={0x5, 0x2, 0x4004, @fd=r5, 0x9db, 0x0, 0xbf1, 0x6, 0x1, {0x1}}, 0xffff) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:41 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x402000, 0x0) setsockopt(r1, 0x6, 0x30, &(0x7f0000000080)="ce6ead5d3b06557ad8862a2dd75e52225f0bffebfc9f8249641d1871e0ba39452681ccd68c6f4e696b203f86742a408fd910c8083264d1733d63003dc6dec22af91431b48874b90af8f00be49276304486f9381cb79ca7a0d9fcd65a3978c94741bdb7b4b9c008f9480c10fc866bcfb51d5e55152c14365e2309e4101355bc0996f26e97c0946c690a3888", 0x8b) 23:56:41 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x42000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:41 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = syz_mount_image$iso9660(&(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', 0x1000, 0x4, &(0x7f0000001440)=[{&(0x7f0000000200)="acd3c0e71a3bffe2e9c69ad6dcb664382ac54452efccdfed7f5742f6c325c8938d8c7c8cfaf732305396a7de7b78df69c57bb3feac5fbe820a4eb2e7d700d58ce5d5e6b9452b00706e69b2fe75f2d2419dba3d79f8e62ee0e302817d", 0x5c, 0x3}, {&(0x7f0000000280)="2998e5a1b3b580e986e6615ac2d433f716c905b57533cf3f5e42ba49bc949dc630847ac0d05870a7f3c2fb663436e60c71689a1be8bafff6a9b4a5321864c217fea91eb0e15b259326d626912eb5947850fa10c425e8cb34910e4ba013a9fad05a93b0325e5b3b4e8b6bab9942b1e782cc4b153d38477835996536aa398ca9deff69e676189add6d154ac6d44b4ab7f72955210a5274506bc2e9688e7c8c4f0b4f20dec607f814205c0b2391a81d6a34339c8403c003d5ce5b21446fcbd7e0232e950348a1e1c285ab4b1c8e42d0e44088", 0xd1, 0x2}, {&(0x7f0000000380)="9f5cf0327e08d2345e28d91457198034b83019610b86c0a420fddd716e589fb61f450bb6e7314c8363c13280c11a010c50f95d4f484581237a25214c7dae6fa56bff8929743b092e07ac5a36144d5834ab0553791032799d9d7adf4853e3cd19f6a97066d23d4227bde4a5737989acb3793fab0a5995138276762ffcd278bface981aeff25a283f960ecfe63d82b01e66c0ef453cd8a701329dbdd9378c5bf24382997af1b7eaf12bae6f5095e6dc633c79ac913f8", 0xb5, 0x9}, {&(0x7f0000000440)="247b7b2d9a6e5cc4cc1cfad80a1720d05cbcbe1ef9aa4859c843ed9bae7083b29785cd626da138a864f48b923f8cc4b7273993a41297c311843e6d3fd11c647cca19b379bbceb93688c0cff0a11674bce76b6f9f5abcd6d6eeb42c3419751ffab2e6ce7ad6fbdf760dde47a8bf5cfdc05a34f37692d6a944e0ac769e7330a120ff195df7d075c2f1ddd5c10d1d7257529f14554e20e4def3eeefef08da676bdd4162ff3f0bacdbe05ee61833e2c87a50b7bd95cc8fe87cb2048c7bbb20a31285567c0b2a376b8200aa87663d1a5b17e2b2526245924bdb71d3589a9ac265a17496a76b5f292758b1e76a51a098a49caeebe86cb3e63490cbe5018a207a5401dec35e646fe76ccde277bbaf7f042b54490a4a0fa104c1ff8b7a61954ad21adc45b927f0502c444b5b03c313482e5ea2e20dd2d458cd183a7b5a4b7757dd54c9fdfe9f6f2d094942fc9e2d1d6ca9b8927c17a886c8c482a304813fb7f945c321c63138d63188c34a52623dc07b55f73c27f2c6072b86f98d879378137a444360bdc32f034e97d745751bc1d0a43377794301c19e0843ec0405c2c2154a863c3e46c805c9f4ab11165cfbc1244d31b47bc3f6c196b86f250de6661f8b3930c03ae9a95773b4119b9f64e3500fdf7d5223d4a057885b2495bacb462caae1633ca8959022f7ce441c744facdd86a1471d9cb6c1efdc17647ca068e36108ee1a78edf091b902625d579b6209272948041fc77b677011ddaf937727778b3d25f5332826c2c9f6f822b2c0252dfd5af637d17db470ba0e5d5e219819e573d73d230cf21ba7cdf60c8264c756f9095d323ed35d286ac4d336c8d35c3a941e882a101067b7f892d5213621466f217b18c11065937d83ef56d0dcd01c129650d86febd8aad3adbf2874ccbfa2f17c1f0a520608fb87f757d415e65be8cab38900a1c098f3435cb53b5ad6fd238cc591b2b760fbf925b238a424b081e8041128f53dc251ae2daac43c6db44f9b1bc5aec74a952e80941e9cce068abadf80105aee830f1e7223edfd4f58d0e68697a10839c854bb8e47a9e57018b2220f633f9be56109b2fadd19c12ee8c3405dff4ffc94eab695c8a4ad2785924bd9099fee84e34aec17a51ef7739b4948329421aedec857810d16db78240f8844fe23947dc7971d5bd845135cdc193785b6d37f83371370e1c0bbdd031480dd411230ad58842ad8863fb12186ce34bba395b5d4f5439d8d56645972010734d9e336acc0d1b7c6eadcecaa4ca5743f8214272b20d6a99807cd8ebab8a68118f68d073afc3df476e7a7d006f9266784de5f285886f7d0f6aa5952140aece37dffdc7a01a4cc7c8af77a81c12a5d89692de7fbd44b41d1a34a34fe78a1f4b2f0c26641d72e93d9280c8ef6ec44c421ea65ddd030fb41e1fe22fa886174e48c059345d4eb4859b652c0059201574c73da1c2ac87f0b2463e816168476f09fb0799e0dd127c41eda35c5abf07e71fc21dc962dea3dedeffe63609c10ec457680cec0de03fdda4d59bf2c9329a2a6fd70f253a4b84ed0710469de3af88f070239f37eb4251fb7e08b252ee8ceb14d970677dd34dc7439d482cc2ff74eba199198ace34e1abd2d5f336993c17e8b1b3cf700578ca45bdabd2badfdbb59a11b07b3d29ea4ad411193aee7bc14c0a962859c8e9a5a555d34069b26b4ba05f870befa9d4cb1bb62eca580fa07bac10a0d9dc104b42123e92320e43e9b5d0eff4519b35945fd040d6a9b1a408f22ded225611d26bc810832544e9e2b2f15897de49b9937d0c1c69ae3844282bfbaeeccbd291fe6dc906861b1da0c6eb3bbfeb8b38ff1978b9d12cd903319a0ab67c5b220b5db1d2deea8ecec72e624cbf32b859c0dca2766510c6a4e47de81737f0f33da42c6d89fa7649a9ee2872214e722714c8c6e89a476b41b8d6c5765729134d6a8c83121b6be11256eb37576dcc3b0735e741c98c2b63d7c63bdb8ccb9479c6db18c2de1f415e33c6b0b288beba0d75a033f4b804455af38d9a2554809d6016dfef820eb5755772cc449a61ec87dcf9ead760579cfad8b02b5b83173adf46c267e3ff2b541e267905830430e516b14330b14d19be8eacde3badbe7cf1a88085aa4b959366e6d2924e41434210e1ddd9678a77913b4c3bc057049c485d3ff1b82a44b207796f8194d92b47aecdc12cff9b8a1a71fc356920d2e2d6403e8357d29153cf81e7f86725d0f61d664d4aae066a6d2a59d836ec5d780c59af3b3c1e0704abef83005378107ac2f45017cfbe184186648591e7492adf455354727a7e879bebf678ab36df5bf3ff0546d7bf70725755841d02e88e5d54449e93a22cd42226f8050b3c5acf42a6c62211868c933e2e3315aedbff813be89c5cb541e15427e5774329e24fda47faadd0c33820265087037eb9e9f7d742f0d506ed506972e1c35b4eee2aeac22c4d73785606bfcaf85b817ebd5045b9f94ef8b9ad6cfcff62f70031429278c46a7a1e688e48b74292462588cf8db1bae3bb792fbf036cec7401b1535146d0921f00b0b707940d8f88b409ee96c28525b06f313af81a69e1cdc967aa65b41e640b52e126c0061f634c242c9963e1c8394dcf929a16587b37c05c7c4f9621f8ca11a251ef1ca083c3ec40ce3f5c8f1ccd2658ceeb205bc6ac89fae384d25e987d5448700c4e803255f9c09af57f328c63a85f2599000d540aa28da50756ebed774d2472a6db52e4e53de3039a8b705d21742714be4949878fd0e24aa0afa942493b2a111e7df3b41868f0bc5fdd614d91931eb02427ec4b7d80dd0a258a25cb1a2e3e282c74b98b70b8d90524cb099eb2985828f033ea808696111e5f8e0ebe7970a9f18168577a629fa6fbb83597fd7c51f49f62e92bb8ce1281c8243e34d524773845eb1c46d056d75b7218f05c1f90bd7a83c7e1d6eacfe77cb33532a4e90e2b436362100edbbd228f168158e450ecafb9116e286886951d97c9c0004ac45a879f12d4bb083644af5ad41d7ad26db911163eaa4c4ca23bfe30f2c5b8cc10a19641907db8f178c6381405558107c7b950371eb04ac1d804e75d902ced67a9a2349e6c9bd65abb5a750fb80eef9dd84aff598e21e21760fbe9d9d2869adee86dac372b74c609079fd15756d03296e27d18707d6590e8624bb454e7250b1430a985822406fbe76cbdc4e651172872a4287e62cccbde918dada7a0de005125d8d1696e8a4a86c08dcea4d936cd3b7d9fea621d06a6d359ab925816fa259a856235770fc552ab1942094525f0821e360c28155c4f333b75c9b22a229a5043db2e3bde30e2d9de9191d31b78eb7095886ed24d240d10df0d0e4ea422b05913d1b8bb66be119fa6dfbb28eb3310894db1f5b81600bec1d817f4ba5660ae25545b747cc9d1cd364e49dc2af0081f99883df1d100d77c989822e3369fafbe6b099f6bc31c416deeb65a35242913e6f41ea590e771c72882f441928bb6e14f4e20e857e9ed51489ad265db5d3ca8192f15a79c0eb66b224bd08cb5818ab4dc292edb0436b5888ccbf5c34e5c1c4f4a56678777e8f8bb2b34145ff20f3b69fdb80305f9f14cf119a81ec376bb90ab4b5970be575d088e1cd3840e505ea0ff79e6667db6cb04733b74aa877214930476d786e816f5442723fd4ee696c2e65f4b8ab7e9403a564d78b3ecc6f6728b2f476559d28dc694072126c45f1827e439c8698f4401df8c4eb56568497fadf5afdae5e1014e0aaff6210abb6f9dddaaa3675ebe12e66cf06bebdb08b86ecc15c8799e8163ec31e74d99af0d2919c3a7a33d523e713c2d1474499c9763d005c5a621174f6a7c0b7c2daf96574cff42cbe2e3e73ed300288684abd39b3a9631d68b0eca208ea178f01c0b84e77491c98e3f7dc1fb2659325056e8db4d4952eda5800a5d30e694647dd448c78dddc835a9ac6c37ce0129bc776557018ecfba671ee368dd45db40f95acb12fbbf7fbf60956321e638691bf38423f2d2ec9b9e31a5f7cfac7d48fadf3b81e8cc6d0cd326697a3971ebc781ac87683e2fe4bba45ba9477663fd6c01be9d230957557a749e23693fa89b32b3e7252e41a7f7421dbd011af703e71f3e63fc92e588cf13ebc7b4efc5757b5346b51a7558cc23fd78e2f39b357584ca4afbb93f9f2750c27a88eea018bd69bfafca62da277840aefc353c8323d2da9d5389511185289995b28438760f44f90815d2c99dcd56660265da85ec7c31a9249b1629454673fb8ff4fc9274b05315a4fb6b4acd4249dec3af91c1adc9060fed076a09ccef710e208fe29d63eb13ecacb9a0a5ebb30f21b301f15990908add6ef8ab83aff85b53214b61586e3199c5adc52e4a9365e5519adcec08be92379dc477d26eb67fc36f922d18e68210fe87818fa067c84dde9fbb68ef75b3d090f953a08a57a29c528fd6caefc596ff7979f76d4eafa6db181acc3605496eb2b056f28fbc6531f1d5a65790bebc7af15d71adda32e72817901031387edc2bb75c6d82488aec4e62a7b2bac05f324f25ed5ec4f4914931e38bfe4744f5b83615729ff77633c183f0fbc758d6e06f04fca316dc7cefc80686fd621943a824136bf0563712c5d8fa9888b603d0108ded3b3a548f918b7205105f3c6a4c0ab51c1331c6f1d6e2b8e47c5f72f88747450ef007774c0a1bde536986e4de364598be7b3a7e68b825de45720a4c2105cde44d87df5ded877f202f838385f95321fc572862186716c54a56284d69f3546b2b86808d6de706c8394791bd1cc28fc2a8f0ef51e51be60d84a09fdbbc57f1129be1ebae92231027ffbea42b223a4dd9d33e743554cae0b819c2a28a97ca2cdb786b44eb2972f613d06814de61448946b67c277ea66c7d15b4cff474ace367a1f905ad9323ff2ecff32a6e476367167996b8b31349508391c4529938f662e5686ef7eeb0a553ee9b52033bf83de515d80b6608d3b245407972bd8f46115dd0f897f988e7439cfc2d4b31c6cc762ee6c3abb352bff49f8b5abb113c6121a6e33abaddd97cf166bc49bcd05cbcfe7f2dc3da68d1da94dac55b3d637bf32c97526ecb98037432944b71c3ab9be81cb20b8baa507f2103e8f3a0b476a37f137ae5f5a6acba4e0713c251828c9ff70109852618e48c907a7541109518c89fed9ca51d268404dbfe9ecc8bf947bfc18ebe595ab33c6cc90d9ade93c7e809f75c7d9ba64814c849e329f92b4b7fb8042574b6359a1aa2d2bf915554ca503b84708e5d6fd8c77aaef0261cd4de02ae843005d2dd55d996a6f6c47986729f7cee2e2e46dc1096322d1aa6af33489f6aa4053c782ec721b845a3250053cd53e8d24fdea3c242fcc38a718c8827a18a4d9f8759dcbd244f45f6699c27e86bade98977467e2902c1a0b184f930c49cae9d2aa866acab70c0407974679a8dcdbdcc2415d55f9cc8c70bf8b711ba9d61b460ee1c604f7672378859ab456a146c5c2451ebecc28978d58ac3b0957475b5c4d5dfd96f759b11b9ee714fedf67b360eec12ef9850da3518ebf3ec74812f63feafad6e13e23ddba1ce7344a6c4aac17b520be2947c4d983b0bbaa6850a0eb34b7b9fe0bf9f880d7076d0b0f9ef338173cd11f789efd1bc2aa810c9c6698eac6c0d584700410660c8295fcad63391856dde6aec31286ebf417838ca06ec793526caaf286c082a0a94db86f7fb6ec8f5eb2a027e3207e09a1c0cd1c89938e0cbe2224a16d9255a4e7a6b69f6fe924cf7960eea82eefbd5b2d1e269e5985c1b02d9e54ce08db014e1b5e4ea12088af51725d7938d9ddf0ba36f8", 0x1000, 0x4}], 0x2001020, &(0x7f0000000140)={[], [{@defcontext={'defcontext', 0x3d, 'unconfined_u'}}]}) preadv(r1, &(0x7f0000001580)=[{&(0x7f00000014c0)=""/190, 0xbe}], 0x1, 0x0, 0x1f) r2 = getpgrp(0x0) perf_event_open(&(0x7f0000000040)={0x3, 0x80, 0x5, 0xbc, 0x1, 0x4, 0x0, 0xfffffffffffffff7, 0x201, 0x8, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x80, 0x4, @perf_config_ext={0x7}, 0x0, 0x10000, 0xfc000, 0x0, 0xb0, 0x80000001, 0x200, 0x0, 0x9, 0x0, 0x8001}, r2, 0xffffffffffffffff, r0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:41 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x74030000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:41 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000600}]) [ 2958.370698][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.379653][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2958.419014][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.427376][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2958.440153][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.449397][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2958.590523][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.598716][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2958.613597][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.621774][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2958.633583][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.642252][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2958.661194][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.669720][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2958.692987][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.701242][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2958.713724][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.721752][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2958.769150][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.777341][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2958.790947][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.799155][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2958.810852][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.819617][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2958.841819][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.850586][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2958.863085][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.871542][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2958.884066][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.892396][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2958.905869][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.915688][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2958.928702][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.936983][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2958.950024][T22474] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2958.958684][T22474] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:43 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x8a000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:43 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:43 executing program 2: r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x13a00, 0xa1) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:43 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000604}]) 23:56:43 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x10000010000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:43 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) r0 = open(&(0x7f0000000040)='./file0\x00', 0x48800, 0x84) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000100)=""/93, 0x5d}, {&(0x7f00000001c0)}, {&(0x7f0000000200)=""/118, 0x76}, {&(0x7f0000000280)=""/46, 0x2e}, {&(0x7f00000002c0)=""/49, 0x31}], 0x5) 23:56:43 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x369}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:43 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x22100) mmap(&(0x7f000036a000/0x1000)=nil, 0x1000, 0x2, 0x810, r1, 0xfbf59000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r2, &(0x7f0000000080), 0x0, 0xff, 0x6) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:43 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x369}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:43 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xf0000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:43 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000700}]) 23:56:43 executing program 0: syz_io_uring_setup(0x4e83, &(0x7f0000000080)={0x0, 0x138c, 0x2}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000000, 0x2010, 0xffffffffffffffff, 0x10000000) r0 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000007, 0x80010, r0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000400)={r0, 0x0, 0xaa5, 0x1}) syz_io_uring_submit(r1, r2, &(0x7f0000000580)=@IORING_OP_STATX={0x15, 0x5, 0x0, r4, &(0x7f0000000440), &(0x7f0000000540)='./file0\x00', 0x200, 0x2400}, 0x0) syz_io_uring_setup(0x64b0, &(0x7f0000000200)={0x0, 0xdea9, 0x2, 0x2, 0x206, 0x0, r0}, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000280), &(0x7f00000002c0)=0x0) syz_io_uring_submit(r3, r5, &(0x7f00000003c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000380)='./file0\x00', 0x12, 0x200840, 0x12345}, 0x7) syz_io_uring_setup(0x1958, &(0x7f0000000100)={0x0, 0x1fc2, 0x20, 0x1, 0x3b8}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000000040), &(0x7f00000001c0)) 23:56:43 executing program 2: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='memory.events\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000080), 0x80, 0x1) sendmsg$SOCK_DIAG_BY_FAMILY(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xdc, 0x14, 0x2, 0x70bd27, 0x25dfdbfc, {0x6, 0x1}, [@INET_DIAG_REQ_BYTECODE={0xc5, 0x1, "8aa9d16b5f188680e8fde433fbc9fe0ff0bb34fed8d1a8884009cce240cde7e23681af0b954ab377289e55127b6d1bfe1aa24e23f0faa92894f3172f3ce0e3c744704e55e28c14661a494e46abf4f4b807798fc28db1ca5182fdb735b3683fe8061c6e013390e6beafe8170ac345a667c56e501b23c9797173a4afd47126a0ed729f91958e8d8beb32223983b4111f195832406a6d6c10adda75dffdcdf1ec6ac4c1fb0b5a38fa89014a82e05cfe6d9670623cca34dc892ccacaa6f4e5fada3197"}]}, 0xdc}, 0x1, 0x0, 0x0, 0x800}, 0x4) signalfd(r0, &(0x7f0000000040)={[0xfff]}, 0x8) [ 2959.697562][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2959.706000][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2959.723164][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2959.732083][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2959.744307][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2959.752772][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2959.787323][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2959.795957][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2959.808741][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2959.817186][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2959.832412][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2959.845214][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2959.858682][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2959.867254][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2959.882315][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2959.891992][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2959.904125][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2959.912649][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2959.956476][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2959.964572][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2959.978797][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2959.987293][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2959.999621][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2960.008767][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2960.026053][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2960.034808][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2960.047214][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2960.055346][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2960.068196][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2960.077392][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2960.091261][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2960.099979][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2960.113370][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2960.121622][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2960.133618][T22513] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2960.142691][T22513] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:44 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:44 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000804}]) 23:56:44 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0xa100, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x10b) flock(r2, 0x2) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r2) sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x40, r3, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x800}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffffffff}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2fb90d3b}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x24000004}, 0x20000040) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r3, 0x221, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x20}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x80000000}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffff9}]}, 0x30}, 0x1, 0x0, 0x0, 0xc014}, 0x4040001) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:44 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xf4ffffff}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:44 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x40000100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:44 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42280, 0x123) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r0, 0xf507, 0x0) ioctl$F2FS_IOC_FLUSH_DEVICE(r1, 0x4008f50a, &(0x7f0000000040)={0xffffffff, 0xfffffffa}) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffffff, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x83) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:44 executing program 0: r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$fscrypt_v1(&(0x7f0000000100), &(0x7f0000000140)={'fscrypt:', @desc4}, &(0x7f0000000200)={0x0, "6b8292344d1979d5a406ab2edc73e2a7979f7279606dfafb79795a005ea5e66679c0ffc9b66664999405c732a10534ed94234bed90bced921e0643d046c0e739"}, 0x48, r0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, 0x0, &(0x7f0000000180)) r2 = add_key$fscrypt_v1(&(0x7f00000001c0), &(0x7f0000000280)={'fscrypt:', @desc1}, &(0x7f0000000400)={0x0, "c7517ea0740cc1a7247387dc652050a93755669534716b62d9239ef85ccdd2aeb83efc078360cf963e146076f2687361df82d0afe92aefd29b64e87e6e621e0f", 0x36}, 0x48, r0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000380)=ANY=[@ANYRESHEX, @ANYRESOCT=r2, @ANYRESDEC=r2], 0x16, r2) r3 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x0}, &(0x7f0000000600)='builtin_trusted\x00', 0xfffffffffffffff9) add_key$fscrypt_v1(&(0x7f0000000480), &(0x7f00000004c0)={'fscrypt:', @desc1}, &(0x7f0000000500)={0x0, "c8c83e02c401fbcff0970c3dbe91fb09c4e7b33532e2c85a8c84f8793546b2f71ffa8ce4c57ca4b110a10794f085f760a9883a084f9c39da9e4b8263a0658c4c", 0x18}, 0x48, r3) syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x4}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f0000fff000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f00000002c0)='keyring\x00', &(0x7f00000003c0)=@secondary) 23:56:44 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r0 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)=0x0) syz_io_uring_setup(0x5a37, &(0x7f0000000100)={0x0, 0x7118, 0x10, 0x2, 0x316, 0x0, r0}, &(0x7f00006d3000/0x4000)=nil, &(0x7f00006d3000/0x4000)=nil, &(0x7f0000000040)=0x0, &(0x7f00000001c0)) r3 = syz_io_uring_setup(0xd9d, &(0x7f0000000100), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f0000000180)) r4 = syz_io_uring_setup(0x21cb, &(0x7f0000000000), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f0000000100)) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r3, 0x6, 0x400000, r5) syz_io_uring_submit(r2, r1, &(0x7f00000007c0)=@IORING_OP_SENDMSG={0x9, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000380)="d7b2f4c8f716b80bdc5bfc3e7cd4e7175657f3fb10fc831a2de7d46ad1825d98e6f8d9b2c0dda3d0ac6780c86e6842f030f706140f3fc6593c0b7cf8ff604a91ff5edb65473ad8a9fdf262638010ab5fa61ed896a25cc55de973b19f2932c8c258f0121ae2f7cabc31d83897a5de6b8dcffc53255150791f79410a6b2160fe95697678e01c5111717a8f2408d3c0ab495ea8494d3579b4f895ff2ef378bae3616c9627eab208", 0xa6}, {&(0x7f0000000280)="5a52d66ee41e3c8b9eb51e09dae559f0375c7232c9493389bcbc015488c09014ff6eeaba69a5554d38cdbda5", 0x2c}, {&(0x7f0000000440)="81245abf53573dd1d14bc1b695e52a577b1467ddc067ba35d4c384ad43ff160a1ae1f74d10f207c6417ee2cdb8b3ce0c8d3cdfcca790d90b3f2ad29315d3c35918a2a9c68e4fc405946bc5ac6fb429579825f38c495c6998dc61da2618212486b2afcaf02e2722dc4bf385ebe95433633654101ebb7cd3f87051cbbae178ee4948aa26758b71e83150eaec3abc70b10c402c6fc397c2fae1db9a76f6db247aaeffcab043e88b2be4f5ffbc03e7bd2b2bcfe13e952d0cf3d44b736fbf8b6cd92bd2ef120f522fb06343f898bdecbe924acf", 0xd1}, {&(0x7f00000002c0)="d5e60f15f12a7f5f338d0e0d8f447ea5697b5efe1cc2c7aa375a2f7c883ffb46b7325f099234676b99da82fede9baa8e1f66f9be06d98da6dda4aff6", 0x3c}, {&(0x7f0000000540)="80b42f0beb61e69e07948760cfb5cf1a113c0b3206c051e8261edbb65836076085eceb6505d88fc1db8dc3520c485ce0306edfe5d530f0d7f1c9c81d20191e", 0x3f}, {&(0x7f0000000580)="f963187faca93e69e8f1ba42a13db9e1c5590b24f54387aeae51ed32a52dc8840d4cd4055a490ddcf05197102fd11b4cff22abab641a", 0x36}], 0x6, &(0x7f0000000800)=ANY=[@ANYBLOB="50000000000000000b010000040000008944e5fd373f8adff314964045f55ae0d9b44c36d37ff5261680931eac2a7c5bdbfc14cb43ae1767374bd93df5779df33226d8b7fa6415d71d3453921ffd8e00d000000000000000020100000900000080a2446f9da9670604456156fd4a3fe5c8db2484d5092dfa70e819fab17aa9bd93aa1ca7b6c7c8800b1584bdaa4cfc8d03a37d4fcbaf58674f27c320929d44f673f4b83b9791778189d051100c078c2908a689f65a47bda57570f2010334a6909379924f351fefc1949016634e54670cb6479a9a1435330dfdad7c6ade9a9f4573dde51874cb356440633e2494406cceaa7ffe209cfb2ecea9a38686c5b96bce2af33eba8bd38d53e82801c0abfcded4effc78ac260a62d628442cf21a4932970cf83b7df72f9695f30000"], 0x120}, 0x0, 0x0, 0x0, {0x0, r5}}, 0x4) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r9, r10, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r9, r10, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r11, 0x0, 0x0, 0x0, 0x40800}, 0x0) r12 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r12, 0x0) preadv(r12, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_submit(r6, r10, &(0x7f0000000680)=@IORING_OP_SEND={0x1a, 0x3, 0x0, r12, 0x0, &(0x7f0000000640), 0x0, 0x40, 0x1, {0x0, r5}}, 0xffff) 23:56:44 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xfeffffff}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:44 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000809}]) 23:56:44 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = openat(r1, &(0x7f0000000140)='./file0\x00', 0x10000, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getegid() fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f00000002c0)='system.posix_acl_default\x00', &(0x7f0000000340)={{}, {0x1, 0x4}, [{0x2, 0x3, r3}], {0x4, 0x6}, [{0x8, 0x2, r4}], {}, {0x20, 0x1}}, 0x34, 0x7) r5 = socket$unix(0x1, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r6) mount$9p_virtio(&(0x7f00000002c0), &(0x7f0000000300)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={'trans=virtio,', {[{@posixacl}, {@dfltgid={'dfltgid', 0x3d, r4}}, {@access_uid={'access', 0x3d, 0xee00}}, {@uname={'uname', 0x3d, '-[)'}}, {@aname={'aname', 0x3d, '+}+^'}}, {@uname={'uname', 0x3d, '([#'}}], [{@fowner_eq={'fowner', 0x3d, r6}}]}}) preadv(r2, &(0x7f0000000100)=[{&(0x7f0000000040)=""/134, 0x86}, {&(0x7f0000000200)=""/192, 0xc0}], 0x2, 0x2, 0x6) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x10, 0x8, 0x28f3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x81, 0x7}, 0x0, 0x0, 0x7}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:44 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r0 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)=0x0) syz_io_uring_setup(0x5a37, &(0x7f0000000100)={0x0, 0x7118, 0x10, 0x2, 0x316, 0x0, r0}, &(0x7f00006d3000/0x4000)=nil, &(0x7f00006d3000/0x4000)=nil, &(0x7f0000000040)=0x0, &(0x7f00000001c0)) r3 = syz_io_uring_setup(0xd9d, &(0x7f0000000100), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f0000000180)) r4 = syz_io_uring_setup(0x21cb, &(0x7f0000000000), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f0000000100)) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r3, 0x6, 0x400000, r5) syz_io_uring_submit(r2, r1, &(0x7f00000007c0)=@IORING_OP_SENDMSG={0x9, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000380)="d7b2f4c8f716b80bdc5bfc3e7cd4e7175657f3fb10fc831a2de7d46ad1825d98e6f8d9b2c0dda3d0ac6780c86e6842f030f706140f3fc6593c0b7cf8ff604a91ff5edb65473ad8a9fdf262638010ab5fa61ed896a25cc55de973b19f2932c8c258f0121ae2f7cabc31d83897a5de6b8dcffc53255150791f79410a6b2160fe95697678e01c5111717a8f2408d3c0ab495ea8494d3579b4f895ff2ef378bae3616c9627eab208", 0xa6}, {&(0x7f0000000280)="5a52d66ee41e3c8b9eb51e09dae559f0375c7232c9493389bcbc015488c09014ff6eeaba69a5554d38cdbda5", 0x2c}, {&(0x7f0000000440)="81245abf53573dd1d14bc1b695e52a577b1467ddc067ba35d4c384ad43ff160a1ae1f74d10f207c6417ee2cdb8b3ce0c8d3cdfcca790d90b3f2ad29315d3c35918a2a9c68e4fc405946bc5ac6fb429579825f38c495c6998dc61da2618212486b2afcaf02e2722dc4bf385ebe95433633654101ebb7cd3f87051cbbae178ee4948aa26758b71e83150eaec3abc70b10c402c6fc397c2fae1db9a76f6db247aaeffcab043e88b2be4f5ffbc03e7bd2b2bcfe13e952d0cf3d44b736fbf8b6cd92bd2ef120f522fb06343f898bdecbe924acf", 0xd1}, {&(0x7f00000002c0)="d5e60f15f12a7f5f338d0e0d8f447ea5697b5efe1cc2c7aa375a2f7c883ffb46b7325f099234676b99da82fede9baa8e1f66f9be06d98da6dda4aff6", 0x3c}, {&(0x7f0000000540)="80b42f0beb61e69e07948760cfb5cf1a113c0b3206c051e8261edbb65836076085eceb6505d88fc1db8dc3520c485ce0306edfe5d530f0d7f1c9c81d20191e", 0x3f}, {&(0x7f0000000580)="f963187faca93e69e8f1ba42a13db9e1c5590b24f54387aeae51ed32a52dc8840d4cd4055a490ddcf05197102fd11b4cff22abab641a", 0x36}], 0x6, &(0x7f0000000800)=ANY=[@ANYBLOB="50000000000000000b010000040000008944e5fd373f8adff314964045f55ae0d9b44c36d37ff5261680931eac2a7c5bdbfc14cb43ae1767374bd93df5779df33226d8b7fa6415d71d3453921ffd8e00d000000000000000020100000900000080a2446f9da9670604456156fd4a3fe5c8db2484d5092dfa70e819fab17aa9bd93aa1ca7b6c7c8800b1584bdaa4cfc8d03a37d4fcbaf58674f27c320929d44f673f4b83b9791778189d051100c078c2908a689f65a47bda57570f2010334a6909379924f351fefc1949016634e54670cb6479a9a1435330dfdad7c6ade9a9f4573dde51874cb356440633e2494406cceaa7ffe209cfb2ecea9a38686c5b96bce2af33eba8bd38d53e82801c0abfcded4effc78ac260a62d628442cf21a4932970cf83b7df72f9695f30000"], 0x120}, 0x0, 0x0, 0x0, {0x0, r5}}, 0x4) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r9, r10, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r9, r10, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r11, 0x0, 0x0, 0x0, 0x40800}, 0x0) r12 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r12, 0x0) preadv(r12, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_submit(r6, r10, &(0x7f0000000680)=@IORING_OP_SEND={0x1a, 0x3, 0x0, r12, 0x0, &(0x7f0000000640), 0x0, 0x40, 0x1, {0x0, r5}}, 0xffff) [ 2960.855787][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2960.864291][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2960.881005][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2960.889404][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2960.902122][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2960.910614][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2960.943869][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2960.952745][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2960.965488][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2960.973783][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2960.985656][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2960.993925][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2961.006936][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2961.015214][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2961.029113][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2961.037541][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2961.049687][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2961.058409][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2961.101771][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2961.111007][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2961.124127][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2961.132635][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2961.145167][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2961.153860][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2961.169209][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2961.177558][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2961.189955][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2961.198792][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2961.211243][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2961.219629][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2961.231612][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2961.240001][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2961.252272][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2961.260949][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2961.272759][T22552] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2961.280993][T22552] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:45 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xffffff7f}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:45 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r0 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)=0x0) syz_io_uring_setup(0x5a37, &(0x7f0000000100)={0x0, 0x7118, 0x10, 0x2, 0x316, 0x0, r0}, &(0x7f00006d3000/0x4000)=nil, &(0x7f00006d3000/0x4000)=nil, &(0x7f0000000040)=0x0, &(0x7f00000001c0)) r3 = syz_io_uring_setup(0xd9d, &(0x7f0000000100), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f0000000180)) r4 = syz_io_uring_setup(0x21cb, &(0x7f0000000000), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f0000000100)) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r3, 0x6, 0x400000, r5) syz_io_uring_submit(r2, r1, &(0x7f00000007c0)=@IORING_OP_SENDMSG={0x9, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000380)="d7b2f4c8f716b80bdc5bfc3e7cd4e7175657f3fb10fc831a2de7d46ad1825d98e6f8d9b2c0dda3d0ac6780c86e6842f030f706140f3fc6593c0b7cf8ff604a91ff5edb65473ad8a9fdf262638010ab5fa61ed896a25cc55de973b19f2932c8c258f0121ae2f7cabc31d83897a5de6b8dcffc53255150791f79410a6b2160fe95697678e01c5111717a8f2408d3c0ab495ea8494d3579b4f895ff2ef378bae3616c9627eab208", 0xa6}, {&(0x7f0000000280)="5a52d66ee41e3c8b9eb51e09dae559f0375c7232c9493389bcbc015488c09014ff6eeaba69a5554d38cdbda5", 0x2c}, {&(0x7f0000000440)="81245abf53573dd1d14bc1b695e52a577b1467ddc067ba35d4c384ad43ff160a1ae1f74d10f207c6417ee2cdb8b3ce0c8d3cdfcca790d90b3f2ad29315d3c35918a2a9c68e4fc405946bc5ac6fb429579825f38c495c6998dc61da2618212486b2afcaf02e2722dc4bf385ebe95433633654101ebb7cd3f87051cbbae178ee4948aa26758b71e83150eaec3abc70b10c402c6fc397c2fae1db9a76f6db247aaeffcab043e88b2be4f5ffbc03e7bd2b2bcfe13e952d0cf3d44b736fbf8b6cd92bd2ef120f522fb06343f898bdecbe924acf", 0xd1}, {&(0x7f00000002c0)="d5e60f15f12a7f5f338d0e0d8f447ea5697b5efe1cc2c7aa375a2f7c883ffb46b7325f099234676b99da82fede9baa8e1f66f9be06d98da6dda4aff6", 0x3c}, {&(0x7f0000000540)="80b42f0beb61e69e07948760cfb5cf1a113c0b3206c051e8261edbb65836076085eceb6505d88fc1db8dc3520c485ce0306edfe5d530f0d7f1c9c81d20191e", 0x3f}, {&(0x7f0000000580)="f963187faca93e69e8f1ba42a13db9e1c5590b24f54387aeae51ed32a52dc8840d4cd4055a490ddcf05197102fd11b4cff22abab641a", 0x36}], 0x6, &(0x7f0000000800)=ANY=[@ANYBLOB="50000000000000000b010000040000008944e5fd373f8adff314964045f55ae0d9b44c36d37ff5261680931eac2a7c5bdbfc14cb43ae1767374bd93df5779df33226d8b7fa6415d71d3453921ffd8e00d000000000000000020100000900000080a2446f9da9670604456156fd4a3fe5c8db2484d5092dfa70e819fab17aa9bd93aa1ca7b6c7c8800b1584bdaa4cfc8d03a37d4fcbaf58674f27c320929d44f673f4b83b9791778189d051100c078c2908a689f65a47bda57570f2010334a6909379924f351fefc1949016634e54670cb6479a9a1435330dfdad7c6ade9a9f4573dde51874cb356440633e2494406cceaa7ffe209cfb2ecea9a38686c5b96bce2af33eba8bd38d53e82801c0abfcded4effc78ac260a62d628442cf21a4932970cf83b7df72f9695f30000"], 0x120}, 0x0, 0x0, 0x0, {0x0, r5}}, 0x4) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r9, r10, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r9, r10, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r11, 0x0, 0x0, 0x0, 0x40800}, 0x0) r12 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r12, 0x0) preadv(r12, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_submit(r6, r10, &(0x7f0000000680)=@IORING_OP_SEND={0x1a, 0x3, 0x0, r12, 0x0, &(0x7f0000000640), 0x0, 0x40, 0x1, {0x0, r5}}, 0xffff) 23:56:45 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:45 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:45 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000040), 0x401, 0x800) mmap(&(0x7f00006e4000/0x3000)=nil, 0x3000, 0x10, 0x4000010, r1, 0x34563000) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x10102, 0x48) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:45 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00080a}]) 23:56:45 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000900}]) 23:56:45 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 23:56:45 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) inotify_add_watch(r1, &(0x7f0000000040)='./file0\x00', 0x20000600) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:45 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xfffffff4}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:45 executing program 0: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r6, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000140)=@IORING_OP_SEND={0x1a, 0x5, 0x0, r0, 0x0, &(0x7f0000000100), 0x0, 0x11, 0x1}, 0xfffff9fd) 23:56:45 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.events\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat$cgroup_int(r2, &(0x7f00000000c0)='cpuset.memory_spread_page\x00', 0x2, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x79f6, @private1, 0x6e119c02}, 0x1c) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0x0, 0xd8, 0x0, 0x0, 0x8, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x0, 0x0, 0x7f}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:45 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xfffffffe}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2962.323885][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.332541][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2962.372352][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.381184][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2962.393281][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.401856][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2962.540535][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.548798][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2962.564620][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.573079][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2962.584806][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.592843][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2962.612723][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.621528][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2962.643346][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.653292][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2962.666978][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.675530][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2962.723183][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.732746][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2962.746987][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.756301][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2962.769652][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.778394][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2962.800158][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.808926][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2962.822018][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.831344][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2962.846037][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.856331][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2962.870990][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.881133][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2962.894848][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.904731][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2962.917894][T22588] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2962.926477][T22588] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:47 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:47 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000908}]) 23:56:47 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xffffffff}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:47 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:47 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x6c00}, 0x882a, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x4000, 0xffffffffffffffff, 0x1) 23:56:47 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) r3 = dup(r0) io_uring_register$IORING_REGISTER_EVENTFD(r3, 0x4, &(0x7f0000000280), 0x1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_uring_enter(0xffffffffffffffff, 0x681d, 0x16c1, 0x2, &(0x7f00000002c0)={[0x3c1]}, 0x8) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000100)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x6000, @fd=r4, 0x48f, &(0x7f0000000200)=""/117, 0x75, 0x12}, 0x6) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x40800}, 0x0) r5 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r9, 0x0) preadv(r9, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(r9, 0xc4009420, &(0x7f0000000380)={0x8, 0x5, {0xe65, @usage=0xffffffff, 0x0, 0x6, 0x8, 0x9, 0x3ccb, 0x2, 0x4, @usage=0x9, 0x3, 0x2, [0x6, 0x100000001, 0x6c3, 0x392, 0x7fffffff, 0x1f]}, {0x5, @struct={0x29b, 0xc365}, 0x0, 0x5, 0x1000, 0x4, 0xfffffffffffffffc, 0x3, 0x440, @usage=0x8, 0xb60, 0x20, [0x8, 0x1, 0x8, 0x1, 0x4635, 0x2]}, {0x7, @usage=0xffffffff, 0x0, 0x0, 0x6, 0xa39d, 0xff, 0xc, 0x80, @struct={0x0, 0x1f}, 0x3, 0x5, [0x5, 0x9, 0x1ff, 0x2, 0x6, 0x7]}, {0x10000, 0x6, 0x4}}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x40800}, 0x0) mmap(&(0x7f00000ca000/0x1000)=nil, 0x1000, 0x3000001, 0x50, r5, 0xb6611000) syz_io_uring_submit(r1, r7, &(0x7f0000000040)=@IORING_OP_WRITE_FIXED={0x5, 0x3, 0x6000, @fd=r0, 0xffff, 0x8000, 0x8000, 0x15, 0x0, {0x3}}, 0x7fffffff) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:47 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000a00}]) 23:56:47 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = mmap$IORING_OFF_CQ_RING(&(0x7f00006d6000/0x1000)=nil, 0x1000, 0x2000003, 0x30, r0, 0x8000000) syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x4, 0x0, 0x8000, 0x3, &(0x7f00000001c0)="4b0b703d83ce0478a28430110e2c766976969686013ad59b44e01f3f38b639c6e198a8d9c1d0e40886e3990e5e91d96cb026ee1aea63e06de6f1218479bbd30a4ab331cc1e361c957622e7581c5b3417e2d6532cd7c8a549134fdc4662456d39d8a3a9f72398ede7e45cf69a88cfd411f5032ba9c5c93bf956e52b16f1594b880b2a95201c2782bc09214699e34260487aa7fd52643dcda81767d8c560662c85b0ded97a32", 0x8, 0x0, 0x0, {0x1}}, 0x62) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:47 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/llc/socket\x00') writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000080)="91d3f32d36f02574d2cb4c3c8bc7d600087e3c792373c1ade736e71362ac1f2b58d8913b0187c7a795002fba9c80e11295f2ff89e7838436fe7af1", 0x3b}, {&(0x7f0000000200)="c8a5b7074df00af17ef628a91453600ea2c4729b5fbcf0808147189796413c99378a19ac1c6c7058add3036ec2b1ce4998797c60bdba9b39dd540cb83896df4cfa57da121e6c804b78945054957b7e347432da580a10dbf65bcaa22136e557ea582bb75db92bc628bf1894495f6038408862c8574534428571b461b0c23c34f957ff8725f0cf1781deb446833663ed68d1f8f358542408552b2ede2965d031641ba434961d8c9b9e3a2e64d3fefb0ac6ec845e086407cb31355d298e68351a7375bb09945ad5f71c3d971d19e8b172d5280ed8c53e0736caf8ee3fe0259c76d18f38ea89128b56e9a6258018966be7dcdc6fdfaba144", 0xf6}], 0x2) 23:56:47 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:47 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$inet6(0xa, 0x1, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) r3 = socket$inet(0x2, 0x3, 0x5) setsockopt$inet_msfilter(r3, 0x0, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB='y'], 0x1) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000040)={0x0, @local, @local}, &(0x7f0000000140)=0xc) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000040)={@rand_addr=' \x01\x00', r4}, 0x14) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000200)={'gre0\x00', &(0x7f00000000c0)={'ip_vti0\x00', 0x0, 0x7, 0x700, 0x4, 0x6, {{0x1d, 0x4, 0x0, 0x9, 0x74, 0x66, 0x0, 0x8, 0x2f, 0x0, @local, @multicast1, {[@rr={0x7, 0x17, 0x4b, [@local, @empty, @remote, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4}, @end, @generic={0x44, 0x8, "7a6a3204b635"}, @rr={0x7, 0x1b, 0x24, [@multicast1, @empty, @multicast2, @dev={0xac, 0x14, 0x14, 0x10}, @dev={0xac, 0x14, 0x14, 0x3a}, @multicast1]}, @timestamp={0x44, 0x20, 0x6e, 0x0, 0x4, [0x0, 0xe3, 0x662, 0x3, 0x7, 0x20, 0x0]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x3, 0x80, 0x4, 0x2, @loopback, @mcast1, 0x8000, 0x20, 0x5, 0x1b5d}}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f00000006c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000680)={&(0x7f0000000740)=ANY=[@ANYBLOB="68030000", @ANYRES16=r1, @ANYBLOB="02002bbd7000ffdbdf250100000008000100", @ANYRES32=r4, @ANYBLOB="bc0002803c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004000100000044000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000110004006163746976656261636b75700000000008000100", @ANYRES32=r5, @ANYBLOB="c4000280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000900000008000600", @ANYRES32=0x0, @ANYBLOB="40000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b00000008000400e3000000080007000000000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b00000008000400ff070000080007000000000008000100", @ANYRES32=0x0, @ANYBLOB="7c000280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000500000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e74000000000000000000000000000005000300030000000800040087f5000008000100", @ANYRES32=r6, @ANYBLOB="3801028040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004000800000008000600", @ANYRES32=0x0, @ANYBLOB="40000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b0000000800040001000000080007000000000040000100240001006c625f706f72745f7374617473000000000000000000000b000000080004000900000008000600f03d48f863034b423348a0ef78e5db92653dec8d42f5e3c6a8ead1fef46506e1ffac2e65b0bee0144816e1d5c12dcc3060da48e0f01c20256b449df51bd6f5c81a8416d6b94d0e08498dc89a97b722ca19f865fa105379d5df367c3569b04e7555d1664d42c68467f43e0c1e181b16aef30fc3bf76ab6bd817e064df2e638f29e666dd6eefe53ccf50f7f960a41142c4cfd76cb558dad4787816b007a428bae38d5dc4d3d818d057e501716c1f40ce0115", @ANYRES32=0x0, @ANYBLOB="3c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000500030003000000080004006a000000"], 0x368}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) preadv(r7, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:47 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = syz_open_dev$vcsu(&(0x7f0000000280), 0x81a, 0x8000) syz_io_uring_setup(0x1b33, &(0x7f00000002c0)={0x0, 0x5da8, 0x0, 0x2, 0x1a9, 0x0, r1}, &(0x7f00003b2000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) r2 = mmap$IORING_OFF_CQ_RING(&(0x7f00003b2000/0x1000)=nil, 0x1000, 0x5, 0x1010, r0, 0x8000000) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x75cf, &(0x7f0000000100)={0x0, 0x107476, 0x0, 0x4}, &(0x7f0000002000/0x4000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) r6 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r6, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) r7 = syz_io_uring_setup(0xd9d, &(0x7f0000000100), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f0000000180)) r8 = syz_io_uring_setup(0x21cb, &(0x7f0000000000), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f0000000100)) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0x6, 0x400000, r9) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r10, r11, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r10, r11, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r12, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_submit(r10, r5, &(0x7f00000004c0)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4, 0x1, {0x0, r9}}, 0x8) syz_io_uring_submit(r4, r5, &(0x7f0000000240)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, r6, &(0x7f0000000040)=0x80, &(0x7f00000001c0)=@l2tp6={0xa, 0x0, 0x0, @dev}, 0x0, 0x80800, 0x1, {0x0, r9}}, 0x7) r13 = dup(r3) syz_io_uring_setup(0x245a, &(0x7f00000003c0)={0x0, 0x7b6f, 0x2, 0x3, 0x268, 0x0, r13}, &(0x7f00006d6000/0x4000)=nil, &(0x7f00006d7000/0x3000)=nil, &(0x7f0000000440), &(0x7f0000000480)) [ 2964.166405][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.175188][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2964.216627][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.225959][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2964.239175][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.249064][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2964.390098][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.398474][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2964.414117][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.422543][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2964.435122][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.443606][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2964.463488][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.472197][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2964.494054][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.502629][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2964.516586][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.525530][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2964.573149][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.581486][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2964.595423][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.603539][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2964.615426][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.623988][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2964.645086][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.653154][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2964.665338][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.673669][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2964.685793][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.694061][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2964.706601][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.714969][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2964.727406][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.735682][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2964.747776][T22628] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2964.755891][T22628] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:49 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:49 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000a08}]) 23:56:49 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x2}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:49 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_setup(0x49e, &(0x7f0000000100)={0x0, 0x6404, 0x1e, 0x2, 0x18b, 0x0, r0}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000040), &(0x7f00000001c0)) 23:56:49 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:49 executing program 2: ioctl$F2FS_IOC_START_VOLATILE_WRITE(0xffffffffffffffff, 0xf503, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) llistxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=""/24, 0x18) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c0b}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:49 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r0 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) r1 = mmap$IORING_OFF_CQ_RING(&(0x7f00006d7000/0x2000)=nil, 0x2000, 0x3000000, 0x50, r0, 0x8000000) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_setup(0x2d24, &(0x7f0000000200)={0x0, 0x2b09, 0x10, 0x0, 0x2b2, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00006d8000/0x1000)=nil, &(0x7f0000000280), &(0x7f00000002c0)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x5, 0x6000, @fd_index=0x4, 0x7, 0x0, 0x0, 0x2, 0x1, {0x3}}, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r6, 0x0, 0x0, 0x0, 0x40800}, 0x0) r7 = mmap$IORING_OFF_SQ_RING(&(0x7f0000782000/0x4000)=nil, 0x4000, 0x4, 0x8010, r0, 0x0) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) shmat(0x0, &(0x7f0000074000/0x1000)=nil, 0x0) syz_io_uring_submit(r7, r5, &(0x7f0000000380)=@IORING_OP_ASYNC_CANCEL={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, {0x0, r8}}, 0x4) r9 = syz_io_uring_setup(0xd9d, &(0x7f0000000100), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f0000000180)) r10 = syz_io_uring_setup(0x21cb, &(0x7f0000000000), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f0000000100)) r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r10, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r9, 0x6, 0x400000, r11) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, &(0x7f0000000040)={0x4000, 0x0, 0x2}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x23456, {0x0, r11}}, 0x1000) 23:56:49 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1800003, 0x10, r0, 0xf6618000) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) syz_mount_image$nfs4(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x5c, 0x2, &(0x7f0000000140)=[{&(0x7f00000000c0)="abbebd43789079d027b8fc6c7b473f9215c528768853d017174bf6aced15f919b98155d3e75f84afdc69c69938a8de4a0dfb6c9f863ed75925d453c871636b0d58a3e356aba0bafb1279320a12cbcfb99357d45bc9adf33d2f0b0ea2c8ec2af555c7c723f152448d116d0a36", 0x6c, 0x1000}, {&(0x7f0000000200)="d8ea5ca1be9b5a9335e211390ad6a2c5960905ce8c1590bcb2946840e4e5b36e9cdc6d34b2a6ff7ac253ff39121d5d884909e33435b41d206df8c59049d8e033b7591b8787cd54df1a4ba5b539a2d07c13c855b8b26a8e6d4c5f2c6f88", 0x5d, 0x3}], 0x3000040, &(0x7f0000000280)={[{'}!<[-'}], [{@euid_lt={'euid<', 0xffffffffffffffff}}, {@obj_user={'obj_user', 0x3d, '(%'}}]}) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1e) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000340), 0x20000, 0x0) perf_event_open(&(0x7f00000002c0)={0x0, 0x80, 0x3c, 0x0, 0x0, 0x5, 0x0, 0x5, 0x20604, 0x2, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0xcdc4ef3be3a15e8f, @perf_config_ext={0x8, 0x100000000}, 0x40000, 0x5, 0x4, 0x9, 0x8, 0x6728, 0x4, 0x0, 0xffffffff, 0x0, 0x1ff}, r1, 0x7, r2, 0x9) 23:56:49 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x4}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:49 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r0 = syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) r1 = mmap$IORING_OFF_CQ_RING(&(0x7f00006d7000/0x2000)=nil, 0x2000, 0x3000000, 0x50, r0, 0x8000000) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_setup(0x2d24, &(0x7f0000000200)={0x0, 0x2b09, 0x10, 0x0, 0x2b2, 0x0, r4}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00006d8000/0x1000)=nil, &(0x7f0000000280), &(0x7f00000002c0)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x5, 0x6000, @fd_index=0x4, 0x7, 0x0, 0x0, 0x2, 0x1, {0x3}}, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r6, 0x0, 0x0, 0x0, 0x40800}, 0x0) r7 = mmap$IORING_OFF_SQ_RING(&(0x7f0000782000/0x4000)=nil, 0x4000, 0x4, 0x8010, r0, 0x0) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) shmat(0x0, &(0x7f0000074000/0x1000)=nil, 0x0) syz_io_uring_submit(r7, r5, &(0x7f0000000380)=@IORING_OP_ASYNC_CANCEL={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, {0x0, r8}}, 0x4) r9 = syz_io_uring_setup(0xd9d, &(0x7f0000000100), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f0000000180)) r10 = syz_io_uring_setup(0x21cb, &(0x7f0000000000), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f0000000100)) r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r10, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r9, 0x6, 0x400000, r11) syz_io_uring_submit(r1, r3, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, &(0x7f0000000040)={0x4000, 0x0, 0x2}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x23456, {0x0, r11}}, 0x1000) 23:56:49 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000c00}]) 23:56:49 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_STATX={0x15, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x80}, 0xfffff47f) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 2965.717844][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2965.726937][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2965.766759][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2965.775102][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2965.787965][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2965.796301][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2965.942281][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2965.951566][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2965.967308][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2965.975620][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2965.987589][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2965.995640][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2966.015400][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2966.023809][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2966.045934][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2966.054481][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2966.068826][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2966.077321][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2966.125006][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2966.133985][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2966.148619][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2966.157919][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2966.170025][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2966.178123][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2966.199821][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2966.208119][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2966.219933][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2966.228184][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2966.240379][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2966.248798][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2966.261706][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2966.269867][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2966.282137][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2966.290398][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2966.302442][T22669] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2966.310548][T22669] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:50 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x7}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:50 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:50 executing program 0: r0 = syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_WRITE={0x17, 0x4, 0x6000, @fd=r1, 0x8001, &(0x7f00000003c0)="6ab075603d8e0ff951d623e464f6d67cf5212a17cab7ad15ca3e3aaccf9b86214e514e62813925fe76c1ee5001afddde5b237842067318e14906c3efb0af99b9e54ab6d136cbdc7f978bb55f7c60440c73508cdc97fc77b0c28a75985b55ef319f14529349f973afb42f17644a10c6739a8991fdefc98aa829c541afe950898d64d4f3d024ffb53dd3cbcd73da00ba5593762bff681c83f0b1922068da68198ac957bb8467a889b659583b67533eda46f8c2d9d23ea5e50dae1dbef5a261107d49b927aef57eaa4454a57073067a13dd671a653b17217e8af6425d4408bf83f7f15283340d76c9e246887e3453d18417a7c1d9f02519994d1fb2c1c20068e7ca348e0ec16650180c89", 0x109, 0x2}, 0x7f) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00003b2000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_setup(0x22fa, &(0x7f0000000100)={0x0, 0x4c80, 0x0, 0x4000001, 0xb0, 0x0, r0}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000040), &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000200)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x1}, 0x3) 23:56:50 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000d00}]) 23:56:50 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:50 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat$cgroup_ro(r0, &(0x7f0000001240)='io.stat\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x183c82, 0x0) openat(r0, &(0x7f0000000040)='./file0\x00', 0x80, 0xde) utime(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0xab1, 0x8}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000119000/0x1000)=nil, 0x1000, 0x200001e, 0x110, r0, 0x9b2df000) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) utimes(&(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={{r2, r3/1000+10000}, {0x77359400}}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$BTRFS_IOC_RM_DEV(0xffffffffffffffff, 0x5000940b, &(0x7f0000000240)={{r4}, "a4970cc8ff8536045507c9cd8b78967fd009298dc1bb470898cf0efd03d41bd8c7f5d58426879ba7aa97c99e754722db2dd5827de5d9e9c4c00b748310cad351e5643f6e7943492e7a234411d0405e16f5b53a299616188ac9c00fb8f9cdff9f43f57bccdfa930205346092e5f5533f3a498a60ffe90d477c2944b4b64912e52e9db891e392efacd1e0b236582fa1d05f79c41c32a92cf0dc403fa69a0332af47540ccb15ab286b308c3e4860bcbc1499e34d09b1aa1cef63316c68f0ada3dd6b1e2d378b2abcf4271e96538d3284e126fa1998f124da6ee8392275f02a4e4335a7ca97f319de3b5cc5e10a67991371a9506339a570469891eb078f9bb050ce654cac47c54767186f066fb95c352a85f9e443b349ccab1c0ae60e80a23620a3daad431e6465c651a7fe9527f39afc13bcd810ec392bcd3b9ddcab54b847de316a6051252c0584da6cf62558fc975f89cfc15947bf0ef6ce49d8f56a8666ad6a22b286784b953652f5d3946d48d709290bb1a07e8b5587a5d7a7d810b076223debf7563be910e4f6b1e81303542ce2208482d7e870c449cc8186d262c10e44886896af84109cfffeccb6aede722ccfafb64b6b3381d621157e8685237ca91992ab8339bfc5ac5470c9cfeb9c506ae53dd2dad6f7d92ac21592b200a890984770f3c2ba2d8e25bda0529b433c3d4aeebabc72500f33c1be8b5c1f7cacf12496d2b754135994a15bcc67963f8148eb8038c335d62606db9060cec14ff27dd2a96a8971fba9ed7d4310bf4cad569d20a6a6557ad39552e1f2faf3aafef196d480701d387bd91dc5d14d57d2d5b1baf90dc17aef8e79b8bbac97d9d848ef9e87f809c3308de940127f4c1ec675ce120fde9a6ac54b62940005bfeff6b364aa9a9485a86909f2d70510025f4431bf652293e51b342f248987ad20f77930541ff161f076d889cf7cb557317ec5c7ff76d6efb3e3bc3938f58215ac8acdb22e6b5226c3ef1e08392e14d82659ef296b28cfe843dc35f429a8d2f3d09a1e84a1d5635003cb9b7cca8ac8d7a40644f868c83268a6fac7eeecc6ab1699e09241ed4f7fea360ec94d75aa5c3cff078a67dd69bd4930b6045dc503b180cf0dd3ff303eecc8eb46f07d6140c3dfc77f6514dd3502b3c064a30aecceb7ec2b59d1c2ad70db63dc5e2012d6af211d4fc0e4b5669aaa4639d080621159646e63385f6261721bb7731e173743b12fd40b9e3981a514c90de1fe06e3d7a5eb2e7a222d4717f432b3a947bdd3bfd85a51bdae851eb70fa6ae416db945331ea430bddf0aa8ea0733640e556c695b2a0e521a172cc22cfb6f8b21c1d01038de7373a11a64204e66243102667a2484de2bd50b702f3afaf5748b22759f8c939eb5cabfde21ffd9d14b0dd44b3261dd3a8dc9b5b8bd11d8cec793d486a383fd9ed485592ae8b7c9671ccac13d9a4c0f89c699e3508f60b40a0f2fa08179fccf4bcb71ab858cbdd486734ff4c3efc4237168225a8ee9705fab142aabc62df8568c12e97289701da5657c73b7931ec099128c684eb6ad1dffe86f96205ebe2f46986dac695f3d81a68b318d0d8de3ea06b2b520c5f977e0ab5cf2448aa8e44d4e2f5180a2ccee3bff77ce239753e9b0d154e8fbedc6cf73e448aae909142b532691cb555558ad76b58b8016bb89d99262f8eff18890a4bc63e30504deedd3e62206c6a62bf2600c60b4e3794e525fb9504b4dbf92678022325e34beabc7b1dcc884e3ebc5023383e58589fa238b8f826398aec819f40fd164fc753019186a66fb54e7aeb12ee91121da30c81aad106300a2f616041ee2e82e9056c0be7d76d34181af6324b102addc0620c30ebe99b32ad423f1cb9aaef7d6a46ec72c3ab8196d067538cc69039b45c2fb27e64742f8831f63c6efc771e8e5e7de237e7f720b8744292648d0f88a5d7fd2a5a4f99c23c992c55cb3e3c71afb53d4623311ebb8fdc843743e99f8a81f9815ed9b7b26559e020f18f007e1cb60f23b9e983a6ed68f99311445bf896ce4bfac87473926f1f257bf0b163a1e04016fd1b9f73bfbeaebd7575339e7f3163e7f9a7822f625279751dad2446574052129b2c5675546276f4b79c7d1bfaea8267501de0659ab61a522d6a19a4a10fa838c23db57dcd0b2a107c96c97149ce9e8a86073858581c590f9b6f1c5edf1160c91556289eacd493184269720684f214e42c1593738a1fba16d66bae343ebfda340815348ae4b2d41e0aed3cfed9a78d911a243025e9c9553eac02ae1798adc5a1d56dfae89cb308757a4cce1c87f4b4ff2b2af6108cb71854dee1c76d841bc846c9f73272ee65b6f851470d24091ab916e93c93622d61f2a55ea9e03280a485333b2c1b3b9637ce1b0eb719270158730ed75e321b70b07f91bf17fdae2cd89555455dcd5f5587d8a5004186a43cbb49f32ecef47db26029da0f82d4ca1d8ae6320c4252117337346f8d27daf3291738cef5d5a295106278c5837578ea12382e0d16e1af221acd20360783bfa37b0d68603a2ef65216f43bb810951fd4bd0f0dcedbd3f61596ba3cc67afd2f435ea61dae00a93c4d9942d948f33c8feb09a718f73016d20e9056a8095592bbd16d7d1833d4ab4dec820aeb5f0a8b8c7cfcf0f754e41cb5b7cb587fa3b998159da8aacb69ad5618ccefcdbe37d7da8ebd4b0adeb96b3611cd7ec0d0334b112cd79861dc2b53fae31c0d2113f8376d00b713878400025cff3ee4c33159f8ea70706b3500b4e5ba918f6a1e68c4577db3914590b7f0f00f452a3b2825c22324a50d37d2af927f9fac6721912105fbcb80c216eb71863a52ff1338413cae12536c73559e836891e5f90476cd1754601d28580fdf275b87df584983795b0bd6c8d17181e18429d58a5542923af29c27b8e76183bc24657cd9a2b611c5b1b12d43339f0620f706765d025967102f5a739e438683b0b8b9db571f91b00f3691e471588ad58b0f6915117c6dc5aba8d6736e365de015b5da7189281bf8ac1b68f6d3fdd64b9a7a7d5c1d740dd325681a13d5f6f4af0974e0bfd5f4c5a082e501a049e012af5fee0acffea99ced39d7a79ef9466b977296e5408784c7cfe13f1de5746bd95fa1189f243382e9083902dd5ca702081e31d6d521e0a32d427394e210259a3a85fa8fe21ae61fd2e2547d04a3eb912928ff18788ab2119bcdd78a724d08ef8adccf025bc3cdb52d742be69a57f285ec18dad2bf95ac20903b44e8260b7a452ab183edffb9bafac8fa030a1a23d377fd491637ca87a3e9aaca6bdff3ddad5d241cccaf5233715654163b9fc133020e5029ec530348c96f75909c7fbd824d926d9ebc7eae8e7ded30f329d5ba075d5c6ac30499254ac534973ae6e2af593311b26a4876ef0967dc3e0f33652bfe15a8bae55869565052320ac710ebe3184219549accb7748afb238e087acad83d3034e9b9c8571f21a20d3af295422c3959cab3e8afa66a908e7406d1bb4149a971f068ca56f5fdbcd9eb4e4288dcbb767145abb3e99a832c3aac92fb00aa6bbc9ee3e54463b4fb192cb49e93b387c815d0c32a8b042b6b736dcf1fbce1cfc2df4ec0031161d005b7c30c99f0a685df85c863f122188fb87a263c8baea4093fa4bf0c8aba6873dd0effe436f11fc52e3fc8e0aed0f8a8b669330b0a3ceb70dbbe5e6f73108d52e9a533848f9552e9b2149f7664efad55e4e842cee542a7f0e0dbaaa6a24cc617068ee7c770a94e34ab82d8cedd4c482d6fb0a008c6d12d8209684094946e8eaef3c8ab1ded04c1e5936f32b5aedadd5fdfb452ac9a1af76a5e825cc99c05538592cca98dd49e3e0baf4a95bb0a75c9316c309e0fd2e69b6bb59b70b6abc99d8a17f4b8aa6cb3ed23371da7473c0244d3521a30e7be73aba2f0916c66f4b427c95a5921ff4d15e0014bb59db19344336e83fac3c8a1d76a5a26c25c3b5b9c21ea6cf3f7359e00fcffb4364b271fa42a01f53839ad14d2f384e18687d08222f8eeb0981d547efe438719653ef991854a4b8ec42ed2c78b6f23691ad0f209aee87132697bcfd8e1c65dbee3aee94c4312e816b75b60f9ba7bed41a49a8c8e3ec26dea9109d209292bcefc5b20d4572539c5d1c089b0c274b469587ff9d618f48412b413994ad231b12060b6c665b1601de1e2641f003429a48218957d83de9b2ee0a8a923c83c369ab5ecac14c9675984021310b9da80fd73f9120da6007e0e0eef7c3265354ab8c84bc5e9ac2220f43f8d937ed0f7b9a01818224dc6612d956b9b24a44d3baece5e8ebb32aac100c06b9c54567daf07c7e0b93f7cea876b5b9c52902607febb371a97947f8d0f230a438c7afa67fd06594245a82627b3f1759a28bdce2387f09cafaefa53cb32836bbc7c1bea45b04f7fa9af43b848243ef5394565bb78cc657a13373939defb7d0ed954e4a0389a8bbab1893d0ca3b2faae1417a0d9c3f451a03f5a7209088baea7ce7ae711cd9481ae326a72bb67ab8fc09917d4d1a5c0a1e139e2a8215fa8a6119d3a7ce81ea486bea28cdfbe263a753eb3078715e9ae9586125697b80ce1738bf112c9eb77090be4267a909752b6162e708b90fad82a83cf321f7cebdc844dc63c7e9f1c3a2b06783ad2b3067d4190afa333553f9cbefb7b85ab875402753c0bf54b507751e756a639bc1118fc47c75445fe68fde3524e46d39004d437f4fc348c09832f36dae456a3cf32043538d9c1955a8033a4d3b0f47d79634f6e63b53649ec42edb5e2fa9b3f9f3f66b9c0e6ab3517d63cea93c63081f564e16adb697164bd3f29831aa3d0d539fa957439989ff84547dcd5d79b88b965bf8834c35625af094fd986d8c7442421e1fada8aada7967f1305654b92c5354cd0b1b5f830d90c27dc02a46c4b1005a2fd791369568f83d0a4f8b7f7854d1c606f8da7737e8727c9bfe276e369117454fb31459b2035f9dca3d2be813237b223d5b06baadc4ff3424b1aaa9a9e38388b9e76c1f479d1d9f19139660d5db7989a887a6b2ea2ae9185977540d0e8a0fd9e4105d7e0116aeb9df4733f8d1df05b266925e164a04b56590e21d7634fc13fe59dabd5b6030b23083be8648092ada168b9df27562d194e29d9512b5e74c90c9fc629b19bf921d26d918f2964b1582afbd2e928b9815247896d54ecf15aa6e9c0714f68d53605c4f5e347273f52bd6869b987a59844db2b7240aed9dc30ddce628ce73c2639f14d6cd87360767576f21e74ad2c5ef66a24b16a59b5b5cb3c74790519d6f4ee691f71e254ce09e75f483edbdb74907730e36871dd9243b137d7596c133fa222929ec7a382d6c883a86ce65e03bcf442eeafe0ed71663f2f65a225df3c5bfb6a7567c714f0da4c7cd71be1acfd1e6805170c55daafddedcb00447859afb5e06d56b6189b8123d557faf695564ee74a6c027db4896b7d4b71446becbdbbdcf79210d6e754e64b5b3282e0bbd07930227d4089c32476146bf8cd7f556f3620b806d04ca469761027daf97594f4c89eeea6ee6d22e4e2777f0bea153b13ce30ef0dc750af8750a63a372e37ee95a9446509c30e482519210b95f68d9b6eefbf7e5ad935aca6e5828ad0ae5731b1fa4bf25d82dd8f5a8e555b12b51632852d6d13092b81fbed54ec7ce54d31d85a6ff53f6653265f9a666f72dabc9942d450140c306f752a4446b42ecb6a9c96e2a0d696c7d19ceea12a5a9e0ca8c94ee1388d6a9cd96dc3e553bdf90564b272d794358cd4779c43cab85d265d817a185abf6674f788e7b04d92a7633be761b30500233468"}) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0xfe, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x809, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x100003, 0x0, 0x0, 0xfffffffd}, 0xffffffffffffffff, 0x0, r1, 0x1) 23:56:50 executing program 0: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000}]) 23:56:50 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0xfffffffe}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:50 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x8}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:50 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r1, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000400)=0x1) preadv(r0, &(0x7f0000001440), 0x0, 0xd9f, 0x100) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) fcntl$getownex(r2, 0x10, &(0x7f00000003c0)) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r4, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) fallocate(r4, 0x60, 0x4, 0xff) sendmsg$nl_netfilter(r3, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="a4010000140101022bbd7000ffdbdf250a0000074d006a000aa6c2a6c230422652c979e958e85be2b6d91d23e50c9acc297e1ec60f87143e746102a1d015ffc63efb0d9683d4c18ad71c9b08883579deb78bae8824f5f4e87f9899c14585a5c0560000003e012480c745a345c7065cc3f8d1d9e83554b2adf483902cf72f46cc92ed871c152449477df924d12daf4d6713dc4bfdc2af4cb97c50fa74c0ffac0ccad9784f726709c2b785bbd3191db0f0653d7e9ef3bd6dee04811715b2d54715ce1370e1d9dc53ce3b3eedc4e1114b74461dbbe778dc33e44fc98cdd88fbf0efc045f59282388cce7e9b4e4cbde34d6c850ef81ef0c97143e6f9513c338152d4519703fef1ca78c4b64c9df5b6b6003d40f5147d755abda34c6b294eee54726e23c8ce3bb8bedd954189f843321d07889c5ba8f4946408003300ac1414bb5a004900bc782c0817edd56652382781eeef771c5383e6080b9c021fe895a708dc804d1a05349f420fa1c337a9236e9edc6a1763f5fdee526fe690ffa293e582ed2d0564f32b204fe68c81c79721dcb385f948caf3171f7103a8000008002500", @ANYRES32=0x0, @ANYBLOB="0000cdbb08ff0000000000000001000000000000f1fa0e474e7115653599fa55e9f4e80000"], 0x1a4}, 0x1, 0x0, 0x0, 0x80}, 0x4040000) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x0, 0x1}, 0xffffffffffffffff, 0xfffffffffffffffe, 0xffffffffffffffff, 0x1) sendfile(r5, r2, &(0x7f0000000200)=0x3ff, 0x1000) 23:56:50 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000e00}]) 23:56:50 executing program 0: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000d00}]) 23:56:50 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x9}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2967.440228][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.448704][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2967.488353][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.497219][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2967.509428][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.517911][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2967.659461][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.667871][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2967.682829][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.691060][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2967.703142][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.711164][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2967.730652][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.738907][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2967.761139][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.769461][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2967.782085][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.790107][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2967.835795][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.845434][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2967.859441][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.868280][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2967.880683][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.889336][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2967.911657][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.921157][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2967.934099][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.942792][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2967.955628][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.964011][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2967.976892][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2967.986305][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2968.000398][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2968.010062][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2968.024187][T22707] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2968.032942][T22707] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:52 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8cffffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:52 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, r0, 0x1) 23:56:52 executing program 0 (fault-call:0 fault-nth:0): syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:56:52 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xa}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:52 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a001200}]) 23:56:52 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 2968.178443][T22749] FAULT_INJECTION: forcing a failure. [ 2968.178443][T22749] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2968.192638][T22749] CPU: 0 PID: 22749 Comm: syz-executor.0 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2968.203157][T22749] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2968.214140][T22749] Call Trace: [ 2968.217696][T22749] dump_stack+0x137/0x19d [ 2968.222129][T22749] should_fail+0x23c/0x250 [ 2968.226829][T22749] should_fail_usercopy+0x16/0x20 [ 2968.232002][T22749] _copy_from_user+0x1c/0xd0 [ 2968.236999][T22749] __x64_sys_io_uring_setup+0x4b/0x120 [ 2968.242689][T22749] ? fput+0x2d/0x130 [ 2968.246630][T22749] ? fpregs_assert_state_consistent+0x7d/0x90 [ 2968.252746][T22749] ? syscall_trace_enter+0x153/0x290 [ 2968.258064][T22749] ? exit_to_user_mode_prepare+0x65/0x190 [ 2968.264670][T22749] do_syscall_64+0x4a/0x90 [ 2968.269285][T22749] entry_SYSCALL_64_after_hwframe+0x44/0xae 23:56:52 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xf6ffffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 2968.275778][T22749] RIP: 0033:0x4665f9 [ 2968.279690][T22749] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2968.300145][T22749] RSP: 002b:00007fb0e311d108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 2968.309315][T22749] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 [ 2968.317672][T22749] RDX: 0000000020ffc000 RSI: 0000000020000080 RDI: 0000000000006b67 23:56:52 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a002000}]) 23:56:52 executing program 0 (fault-call:0 fault-nth:1): syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:56:52 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xf}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:52 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r2 = openat2(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x101000}, 0x18) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001640)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) socketpair(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, 0x0) sendmsg$NLBL_CIPSOV4_C_REMOVE(r5, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f0000001840)=ANY=[@ANYRES32, @ANYRES32=r4, @ANYRESOCT, @ANYRES32=r3, @ANYRES64, @ANYRESHEX], 0x3}, 0x1, 0x0, 0x0, 0x4}, 0x40025) r6 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r6, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) getsockname(r6, &(0x7f0000000400)=@ax25={{0x3, @default}, [@rose, @remote, @remote, @netrom, @default, @rose, @netrom, @null]}, &(0x7f00000000c0)=0x80) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000200)={"d851a13b78abd5a68275242060a594c9", 0x0, 0x0, {0x800, 0xffffffff}, {0x14046, 0x10000}, 0x8, [0x81, 0xffffffffffffff1d, 0x73e, 0x6, 0x3f, 0x7fffffff, 0x5, 0x7, 0x2, 0x5, 0x3, 0x9, 0x7ff, 0xfffffffffffffc80, 0x800, 0x8]}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000000300)={"bba5f4c9883cd52084eb7c3e9fb32e1d", r4, r7, {0x7, 0xffff}, {0x0, 0x9}, 0x5, [0x8, 0x1, 0x3, 0x9, 0x9, 0x9, 0x10001, 0x9, 0x6, 0x5634, 0x8000, 0x4, 0x5, 0x6, 0x0, 0xff]}) [ 2968.326185][T22749] RBP: 0000000020000080 R08: 0000000000000000 R09: 0000000000000000 [ 2968.335392][T22749] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2968.343769][T22749] R13: 0000000020ffc000 R14: 0000000000000000 R15: 0000000020ffc000 23:56:52 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfeffffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 2968.645084][T22775] FAULT_INJECTION: forcing a failure. [ 2968.645084][T22775] name failslab, interval 1, probability 0, space 0, times 0 [ 2968.658553][T22775] CPU: 0 PID: 22775 Comm: syz-executor.0 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2968.668973][T22775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2968.679925][T22775] Call Trace: [ 2968.683471][T22775] dump_stack+0x137/0x19d [ 2968.688092][T22775] should_fail+0x23c/0x250 [ 2968.692840][T22775] __should_failslab+0x81/0x90 [ 2968.697777][T22775] ? io_uring_create+0x120/0x18d0 [ 2968.703219][T22775] should_failslab+0x5/0x20 [ 2968.707887][T22775] kmem_cache_alloc_trace+0x49/0x310 [ 2968.713737][T22775] io_uring_create+0x120/0x18d0 [ 2968.720376][T22775] ? vfs_write+0x50c/0x770 [ 2968.725267][T22775] ? should_fail+0xd6/0x250 [ 2968.729857][T22775] __x64_sys_io_uring_setup+0xe1/0x120 [ 2968.736457][T22775] do_syscall_64+0x4a/0x90 [ 2968.740962][T22775] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2968.747008][T22775] RIP: 0033:0x4665f9 [ 2968.751229][T22775] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2968.772522][T22775] RSP: 002b:00007fb0e311d108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 2968.782884][T22775] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 23:56:52 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xffffff7f00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:52 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:56:53 executing program 0 (fault-call:0 fault-nth:2): syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:56:53 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x21}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2968.792645][T22775] RDX: 0000000020ffc000 RSI: 0000000020000080 RDI: 0000000000006b67 [ 2968.803350][T22775] RBP: 0000000020000080 R08: 0000000000000000 R09: 0000000000000000 [ 2968.812012][T22775] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2968.820503][T22775] R13: 0000000020ffc000 R14: 0000000000000000 R15: 0000000020ffc000 23:56:53 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a003f00}]) [ 2969.287225][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2969.297888][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2969.337616][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2969.346777][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2969.360571][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2969.369254][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2969.512831][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2969.521634][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2969.536568][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2969.545804][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2969.557646][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2969.566373][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2969.585408][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2969.593526][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2969.615839][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2969.625087][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2969.639291][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2969.648533][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2969.704320][T22789] FAULT_INJECTION: forcing a failure. [ 2969.704320][T22789] name failslab, interval 1, probability 0, space 0, times 0 [ 2969.717937][T22789] CPU: 0 PID: 22789 Comm: syz-executor.0 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2969.729209][T22789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2969.740551][T22789] Call Trace: [ 2969.743944][T22789] dump_stack+0x137/0x19d [ 2969.748377][T22789] should_fail+0x23c/0x250 [ 2969.753316][T22789] ? io_uring_create+0x190/0x18d0 [ 2969.759174][T22789] __should_failslab+0x81/0x90 [ 2969.764751][T22789] should_failslab+0x5/0x20 [ 2969.769587][T22789] __kmalloc+0x66/0x340 [ 2969.774147][T22789] ? kmem_cache_alloc_trace+0x215/0x310 [ 2969.780455][T22789] ? io_uring_create+0x120/0x18d0 [ 2969.785934][T22789] io_uring_create+0x190/0x18d0 [ 2969.791380][T22789] ? vfs_write+0x50c/0x770 [ 2969.796077][T22789] ? should_fail+0xd6/0x250 [ 2969.800766][T22789] __x64_sys_io_uring_setup+0xe1/0x120 [ 2969.806398][T22789] do_syscall_64+0x4a/0x90 [ 2969.807082][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2969.810928][T22789] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2969.819215][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2969.825475][T22789] RIP: 0033:0x4665f9 [ 2969.825493][T22789] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2969.825510][T22789] RSP: 002b:00007fb0e311d108 EFLAGS: 00000202 [ 2969.843676][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2969.845538][T22789] ORIG_RAX: 00000000000001a9 [ 2969.845546][T22789] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 [ 2969.845557][T22789] RDX: 0000000020ffc000 RSI: 0000000020000080 RDI: 0000000000006b67 [ 2969.845570][T22789] RBP: 0000000020000080 R08: 0000000000000000 R09: 0000000000000000 [ 2969.868099][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2969.875713][T22789] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2969.875731][T22789] R13: 0000000020ffc000 R14: 0000000000000000 R15: 0000000020ffc000 [ 2969.953105][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2969.963256][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2969.999858][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2970.009213][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2970.022733][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2970.032651][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2970.054308][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2970.063847][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2970.079139][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2970.088402][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2970.102125][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2970.110637][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2970.123692][T22748] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2970.132892][T22748] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:54 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:54 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x100000, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x2, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000012c0), 0x6c00}, 0x0, 0x1ff, 0x2000, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xb) r1 = socket$inet6(0xa, 0x80803, 0x87) preadv(r0, &(0x7f0000001280)=[{&(0x7f0000000200)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/5, 0x5}, {&(0x7f0000001200)=""/125, 0x7d}], 0x3, 0xfffffeff, 0x529b) getsockopt$inet6_opts(r1, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) fcntl$getownex(r0, 0x10, &(0x7f0000001340)={0x0, 0x0}) wait4(r2, &(0x7f0000001380), 0x1, &(0x7f00000013c0)) truncate(&(0x7f0000001300)='./file0\x00', 0x7) write(r1, &(0x7f0000000040)="343fbec89345db3411e785cdd548377eb7d8e867a1e9d6d8b33a76c23e049843c91f3ed981fe956a3575842ce9a00ef3c532c900", 0x34) 23:56:54 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xffffffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:54 executing program 0 (fault-call:0 fault-nth:3): syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:56:54 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x42}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:54 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a004000}]) [ 2970.235482][T22807] FAULT_INJECTION: forcing a failure. [ 2970.235482][T22807] name failslab, interval 1, probability 0, space 0, times 0 [ 2970.249489][T22807] CPU: 0 PID: 22807 Comm: syz-executor.0 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2970.261374][T22807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2970.272107][T22807] Call Trace: [ 2970.277134][T22807] dump_stack+0x137/0x19d 23:56:54 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a006300}]) 23:56:54 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:54 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000040)) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 2970.282043][T22807] should_fail+0x23c/0x250 [ 2970.286653][T22807] __should_failslab+0x81/0x90 [ 2970.292241][T22807] ? io_uring_create+0x1e1/0x18d0 [ 2970.297277][T22807] should_failslab+0x5/0x20 [ 2970.302028][T22807] kmem_cache_alloc_trace+0x49/0x310 [ 2970.307748][T22807] ? io_uring_create+0x190/0x18d0 [ 2970.312904][T22807] io_uring_create+0x1e1/0x18d0 [ 2970.317949][T22807] ? vfs_write+0x50c/0x770 [ 2970.322627][T22807] ? should_fail+0xd6/0x250 [ 2970.327379][T22807] __x64_sys_io_uring_setup+0xe1/0x120 [ 2970.334727][T22807] do_syscall_64+0x4a/0x90 [ 2970.339410][T22807] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2970.346335][T22807] RIP: 0033:0x4665f9 [ 2970.350730][T22807] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2970.371898][T22807] RSP: 002b:00007fb0e311d108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 23:56:54 executing program 0 (fault-call:0 fault-nth:4): syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:56:54 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x8a}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2970.382953][T22807] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 [ 2970.392482][T22807] RDX: 0000000020ffc000 RSI: 0000000020000080 RDI: 0000000000006b67 [ 2970.401475][T22807] RBP: 0000000020000080 R08: 0000000000000000 R09: 0000000000000000 [ 2970.410373][T22807] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2970.418817][T22807] R13: 0000000020ffc000 R14: 0000000000000000 R15: 0000000020ffc000 23:56:54 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="1000400017010007002e2f66696c6530"], 0x10) [ 2970.567897][T22827] FAULT_INJECTION: forcing a failure. [ 2970.567897][T22827] name failslab, interval 1, probability 0, space 0, times 0 [ 2970.581274][T22827] CPU: 0 PID: 22827 Comm: syz-executor.0 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2970.592062][T22827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2970.602609][T22827] Call Trace: [ 2970.606209][T22827] dump_stack+0x137/0x19d [ 2970.610656][T22827] should_fail+0x23c/0x250 [ 2970.615429][T22827] __should_failslab+0x81/0x90 [ 2970.620262][T22827] ? percpu_ref_init+0x9e/0x210 [ 2970.625331][T22827] should_failslab+0x5/0x20 [ 2970.630084][T22827] kmem_cache_alloc_trace+0x49/0x310 [ 2970.635629][T22827] percpu_ref_init+0x9e/0x210 [ 2970.640650][T22827] ? io_uring_create+0x18d0/0x18d0 [ 2970.645891][T22827] io_uring_create+0x228/0x18d0 [ 2970.651003][T22827] ? vfs_write+0x50c/0x770 [ 2970.655515][T22827] ? should_fail+0xd6/0x250 [ 2970.660387][T22827] __x64_sys_io_uring_setup+0xe1/0x120 [ 2970.666462][T22827] do_syscall_64+0x4a/0x90 [ 2970.670901][T22827] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2970.677834][T22827] RIP: 0033:0x4665f9 [ 2970.682019][T22827] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2970.704415][T22827] RSP: 002b:00007fb0e311d108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 2970.713395][T22827] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 [ 2970.721992][T22827] RDX: 0000000020ffc000 RSI: 0000000020000080 RDI: 0000000000006b67 [ 2970.730547][T22827] RBP: 0000000020000080 R08: 0000000000000000 R09: 0000000000000000 [ 2970.738730][T22827] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2970.747469][T22827] R13: 0000000020ffc000 R14: 0000000000000000 R15: 0000000020ffc000 [ 2971.415303][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.425151][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2971.462936][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.472928][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2971.485868][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.495276][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2971.636628][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.648151][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2971.665624][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.675887][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2971.689779][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.699748][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2971.720268][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.730361][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2971.754520][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.764534][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2971.780451][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.788812][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2971.836751][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.848982][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2971.863794][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.876843][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2971.890891][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.899646][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2971.922771][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.932475][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2971.946035][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.955001][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2971.967501][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2971.980299][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2971.992869][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2972.002164][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2972.016223][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2972.024837][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2972.037609][T22808] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2972.046325][T22808] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:56 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:56 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a008102}]) 23:56:56 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:56 executing program 0 (fault-call:0 fault-nth:5): syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:56:56 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xf0}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:56 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = fork() r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1e) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r2, 0x0, 0x0) r3 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r3, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r3, &(0x7f0000000040)={r0, r0, 0xfff}) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 2972.134671][T22848] FAULT_INJECTION: forcing a failure. [ 2972.134671][T22848] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2972.149882][T22848] CPU: 0 PID: 22848 Comm: syz-executor.0 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2972.160629][T22848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2972.173610][T22848] Call Trace: [ 2972.178901][T22848] dump_stack+0x137/0x19d [ 2972.184645][T22848] should_fail+0x23c/0x250 [ 2972.190790][T22848] __alloc_pages+0x102/0x320 [ 2972.195656][T22848] alloc_pages+0x21d/0x310 [ 2972.201518][T22848] __get_free_pages+0x8/0x30 [ 2972.206385][T22848] io_uring_create+0x887/0x18d0 [ 2972.212091][T22848] ? should_fail+0xd6/0x250 [ 2972.217318][T22848] __x64_sys_io_uring_setup+0xe1/0x120 [ 2972.224269][T22848] do_syscall_64+0x4a/0x90 23:56:56 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000400)=[{&(0x7f0000000300)=""/237, 0xed}, {&(0x7f0000000440)=""/139, 0x8b}], 0x2, 0xd9f, 0x0) preadv(r0, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/66, 0x42}, {&(0x7f0000000200)=""/203, 0xcb}], 0x2, 0xc1, 0x10000) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$unix(r1, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mknodat$loop(r2, &(0x7f0000000540)='./file1\x00', 0x1, 0x1) syz_io_uring_setup(0x3350, &(0x7f0000000040)={0x0, 0xf69e, 0x2}, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000bfd000/0x400000)=nil, &(0x7f00000000c0), &(0x7f0000000580)) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x1, 0x9c) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) fsconfig$FSCONFIG_SET_PATH(r3, 0x3, &(0x7f0000000140)='\x00', &(0x7f0000000500)='./file0\x00', r4) [ 2972.228863][T22848] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2972.235587][T22848] RIP: 0033:0x4665f9 [ 2972.239602][T22848] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2972.261601][T22848] RSP: 002b:00007fb0e311d108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 2972.270833][T22848] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 23:56:56 executing program 0 (fault-call:0 fault-nth:6): syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:56:56 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xfe}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2972.281336][T22848] RDX: 0000000020ffc000 RSI: 0000000020000080 RDI: 0000000000006b67 [ 2972.290767][T22848] RBP: 0000000020000080 R08: 0000000000000000 R09: 0000000000000000 [ 2972.300993][T22848] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2972.310401][T22848] R13: 0000000020ffc000 R14: 0000000000000000 R15: 0000000020ffc000 23:56:56 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a008200}]) [ 2972.442767][T22863] FAULT_INJECTION: forcing a failure. [ 2972.442767][T22863] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2972.460512][T22863] CPU: 0 PID: 22863 Comm: syz-executor.0 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2972.473961][T22863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2972.488384][T22863] Call Trace: [ 2972.494077][T22863] dump_stack+0x137/0x19d [ 2972.499215][T22863] should_fail+0x23c/0x250 [ 2972.504919][T22863] __alloc_pages+0x102/0x320 [ 2972.510188][T22863] alloc_pages+0x21d/0x310 [ 2972.514865][T22863] __get_free_pages+0x8/0x30 [ 2972.519886][T22863] io_uring_create+0x9b9/0x18d0 [ 2972.524823][T22863] ? should_fail+0xd6/0x250 [ 2972.529618][T22863] __x64_sys_io_uring_setup+0xe1/0x120 [ 2972.535897][T22863] do_syscall_64+0x4a/0x90 [ 2972.540596][T22863] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2972.546939][T22863] RIP: 0033:0x4665f9 [ 2972.551920][T22863] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2972.577640][T22863] RSP: 002b:00007fb0e311d108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 23:56:56 executing program 0 (fault-call:0 fault-nth:7): syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 2972.589244][T22863] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 [ 2972.598878][T22863] RDX: 0000000020ffc000 RSI: 0000000020000080 RDI: 0000000000006b67 [ 2972.608023][T22863] RBP: 0000000020000080 R08: 0000000000000000 R09: 0000000000000000 [ 2972.618775][T22863] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2972.627759][T22863] R13: 0000000020ffc000 R14: 0000000000000000 R15: 0000000020ffc000 [ 2972.696304][T22871] FAULT_INJECTION: forcing a failure. [ 2972.696304][T22871] name failslab, interval 1, probability 0, space 0, times 0 [ 2972.711920][T22871] CPU: 0 PID: 22871 Comm: syz-executor.0 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2972.724246][T22871] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2972.736524][T22871] Call Trace: [ 2972.740283][T22871] dump_stack+0x137/0x19d [ 2972.745646][T22871] should_fail+0x23c/0x250 [ 2972.750797][T22871] __should_failslab+0x81/0x90 [ 2972.756696][T22871] ? io_uring_create+0x13f7/0x18d0 [ 2972.763365][T22871] should_failslab+0x5/0x20 [ 2972.768868][T22871] kmem_cache_alloc_trace+0x49/0x310 [ 2972.774258][T22871] ? alloc_pages+0x21d/0x310 [ 2972.779115][T22871] io_uring_create+0x13f7/0x18d0 [ 2972.784648][T22871] ? should_fail+0xd6/0x250 [ 2972.789751][T22871] __x64_sys_io_uring_setup+0xe1/0x120 [ 2972.795485][T22871] do_syscall_64+0x4a/0x90 [ 2972.800408][T22871] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2972.806796][T22871] RIP: 0033:0x4665f9 [ 2972.810883][T22871] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2972.831098][T22871] RSP: 002b:00007fb0e311d108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 23:56:57 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x204}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2972.844540][T22871] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 [ 2972.853623][T22871] RDX: 0000000020ffc000 RSI: 0000000020000080 RDI: 0000000000006b67 [ 2972.862042][T22871] RBP: 0000000020000080 R08: 0000000000000000 R09: 0000000000000000 [ 2972.871817][T22871] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2972.881685][T22871] R13: 0000000020ffc000 R14: 0000000000000000 R15: 0000000020ffc000 [ 2973.461171][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2973.472981][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2973.519532][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2973.529438][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2973.542671][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2973.551920][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2973.695922][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2973.705744][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2973.722850][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2973.731349][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2973.744908][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2973.755948][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2973.779684][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2973.791073][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2973.816296][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2973.827891][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2973.846554][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2973.856906][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2973.910905][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2973.923727][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2973.941441][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2973.953250][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2973.969715][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2973.982813][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2974.006204][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2974.015126][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2974.029380][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2974.038757][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2974.054277][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2974.064068][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2974.078991][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2974.089034][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2974.102448][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2974.112149][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2974.126202][T22849] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2974.136812][T22849] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:56:58 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x374}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:56:58 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:58 executing program 0 (fault-call:0 fault-nth:8): syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:56:58 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:58 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00e803}]) 23:56:58 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x2000000a}, 0xc, &(0x7f0000000680)={&(0x7f00000008c0)=ANY=[@ANYBLOB="ac000000eab61b9650f26bb41f82af91992ebbecc9562dd52b89e1444cd616e1f694ee1662d0a7e739914a28715a069210c2b766a26c026a3908fadf625c487a54bc076516266b4b95510000000001000000542a57a572bcfaeb71e9d3b0ae3f00000000ac4ba9fedb79c4d2def07ac83a97cfee4c69cbc6a96586537c6903a57230d5200fe8fc95f62c62fb1461f40d1ded5cf69ae14f61dcbb5c38bdf0eb989d83dacb6ecf6a719148c1c4d9214539527c643ee1e66d717efd07c36ef6befd8c593eeae9c6", @ANYRES16=0x0, @ANYBLOB="00012cbd7000fedbdf25060000001c00e700bbcd6436eb2a673835fb34460a9339d504dc469ee386e8980a00180003030303030300000a001800030303030303000008000500020000000800050005000000080005000c0000000a00e80008021100000100000a00e80008021100000100000a00e80008021100000000000a00e800ffffffffffff00000a00e80008021100000100000800050005000000080005000a000000a36cffe5db501066a79cee5e8a9b8cb62a0ecf71"], 0xac}, 0x1, 0x0, 0x0, 0x184679270d0d4697}, 0x80) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(r2, &(0x7f0000000880)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000840)={&(0x7f0000000d00)=ANY=[@ANYBLOB="68000000dfc0a27980f144af71d0be15f74c5c1108dcb3f9b65741f6da7ab1987568a89be8d366df342b1d1af3e5c1d851a82995337dffa6890edb3977e3e12a9e468f14ed14cd257da577c4a49bcb7643d88dec77bad23c5200", @ANYRES16=0x0, @ANYBLOB="00022cbd7000fbdbdf25010000000000000008410000004c0018fffffbe373797a30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000edb31968087393a55fad83f834533ee55445b16ed78fbf35737d145193832530586e03ac3a2665ca7a49040cd9233bd29c51f022881c1a754a5b972f0825efa76767cad8a7b34e84b4674d36fe7b42c223f350be65ee68364e4bf12a59574fdce9e4933ddebac17c59058e830efb4fce22501e94b535a6d12a9fa3111ecea2e8cf4aa3f5dfc47928543d91adc2e13c62d3c083d2f47212edeeee8d34ed8ff08b67d7ea5d70595009843a6a486b8dc25f5672aca9c1322f4729bee"], 0x68}, 0x1, 0x0, 0x0, 0x20004004}, 0x4000000) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r4 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r4, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) preadv(r4, &(0x7f0000000500)=[{&(0x7f0000000080)=""/134, 0x86}, {&(0x7f0000000140)=""/23, 0x17}, {&(0x7f0000000200)=""/170, 0xaa}, {&(0x7f00000002c0)=""/217, 0xd9}, {&(0x7f00000003c0)=""/198, 0xc6}, {&(0x7f00000004c0)=""/21, 0x15}], 0x6, 0x5a, 0x7ff) ioctl$BLKBSZSET(r3, 0x40081271, &(0x7f0000000040)=0xb2) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 2974.278906][T22890] FAULT_INJECTION: forcing a failure. [ 2974.278906][T22890] name failslab, interval 1, probability 0, space 0, times 0 [ 2974.292883][T22890] CPU: 0 PID: 22890 Comm: syz-executor.0 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2974.304030][T22890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2974.314687][T22890] Call Trace: [ 2974.318200][T22890] dump_stack+0x137/0x19d [ 2974.323239][T22890] should_fail+0x23c/0x250 [ 2974.327734][T22890] __should_failslab+0x81/0x90 [ 2974.333288][T22890] ? percpu_ref_init+0x9e/0x210 [ 2974.338793][T22890] should_failslab+0x5/0x20 [ 2974.344282][T22890] kmem_cache_alloc_trace+0x49/0x310 [ 2974.352936][T22890] percpu_ref_init+0x9e/0x210 [ 2974.360120][T22890] ? __io_register_rsrc_update+0x1260/0x1260 [ 2974.368489][T22890] io_uring_create+0x1419/0x18d0 [ 2974.375355][T22890] ? should_fail+0xd6/0x250 [ 2974.381577][T22890] __x64_sys_io_uring_setup+0xe1/0x120 [ 2974.388439][T22890] do_syscall_64+0x4a/0x90 [ 2974.393844][T22890] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2974.401854][T22890] RIP: 0033:0x4665f9 [ 2974.407191][T22890] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2974.432907][T22890] RSP: 002b:00007fb0e311d108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 2974.445399][T22890] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 [ 2974.455484][T22890] RDX: 0000000020ffc000 RSI: 0000000020000080 RDI: 0000000000006b67 [ 2974.466100][T22890] RBP: 0000000020000080 R08: 0000000000000000 R09: 0000000000000000 [ 2974.476294][T22890] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2974.486600][T22890] R13: 0000000020ffc000 R14: 0000000000000000 R15: 0000000020ffc000 23:56:58 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00efff}]) 23:56:58 executing program 0 (fault-call:0 fault-nth:9): syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:56:58 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x402}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2974.761993][T22906] FAULT_INJECTION: forcing a failure. [ 2974.761993][T22906] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2974.778997][T22906] CPU: 0 PID: 22906 Comm: syz-executor.0 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2974.792635][T22906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2974.805053][T22906] Call Trace: [ 2974.808397][T22906] dump_stack+0x137/0x19d [ 2974.813218][T22906] should_fail+0x23c/0x250 [ 2974.818822][T22906] should_fail_usercopy+0x16/0x20 [ 2974.825584][T22906] _copy_to_user+0x1c/0x90 [ 2974.830949][T22906] io_uring_create+0x159f/0x18d0 [ 2974.838413][T22906] ? should_fail+0xd6/0x250 [ 2974.843875][T22906] __x64_sys_io_uring_setup+0xe1/0x120 [ 2974.852149][T22906] do_syscall_64+0x4a/0x90 [ 2974.857793][T22906] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2974.864021][T22906] RIP: 0033:0x4665f9 [ 2974.868114][T22906] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2974.888755][T22906] RSP: 002b:00007fb0e311d108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 2974.897487][T22906] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 [ 2974.906231][T22906] RDX: 0000000020ffc000 RSI: 0000000020000080 RDI: 0000000000006b67 [ 2974.914829][T22906] RBP: 0000000020000080 R08: 0000000000000000 R09: 0000000000000000 [ 2974.923151][T22906] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2974.931144][T22906] R13: 0000000020ffc000 R14: 0000000000000000 R15: 0000000020ffc000 23:56:59 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00f600}]) 23:56:59 executing program 0 (fault-call:0 fault-nth:10): syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 2975.235140][T22915] FAULT_INJECTION: forcing a failure. [ 2975.235140][T22915] name failslab, interval 1, probability 0, space 0, times 0 [ 2975.249743][T22915] CPU: 0 PID: 22915 Comm: syz-executor.0 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2975.265728][T22915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2975.277021][T22915] Call Trace: [ 2975.280577][T22915] dump_stack+0x137/0x19d [ 2975.285299][T22915] should_fail+0x23c/0x250 [ 2975.290063][T22915] ? sock_alloc_inode+0x23/0x90 [ 2975.295259][T22915] __should_failslab+0x81/0x90 [ 2975.301037][T22915] ? sockfs_init_fs_context+0x70/0x70 [ 2975.306859][T22915] should_failslab+0x5/0x20 [ 2975.311725][T22915] kmem_cache_alloc+0x46/0x2f0 [ 2975.317048][T22915] ? selinux_socket_create+0x7c/0x170 [ 2975.323286][T22915] ? sockfs_init_fs_context+0x70/0x70 [ 2975.328749][T22915] sock_alloc_inode+0x23/0x90 [ 2975.333710][T22915] ? sockfs_init_fs_context+0x70/0x70 [ 2975.339398][T22915] new_inode_pseudo+0x38/0x1c0 [ 2975.344281][T22915] __sock_create+0x122/0x4f0 [ 2975.349660][T22915] ? should_fail+0xd6/0x250 [ 2975.355099][T22915] sock_create_kern+0x34/0x40 [ 2975.360134][T22915] io_uring_create+0x15e5/0x18d0 [ 2975.365276][T22915] ? should_fail+0xd6/0x250 [ 2975.370346][T22915] __x64_sys_io_uring_setup+0xe1/0x120 [ 2975.375916][T22915] do_syscall_64+0x4a/0x90 [ 2975.380762][T22915] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2975.387348][T22915] RIP: 0033:0x4665f9 [ 2975.391258][T22915] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2975.412762][T22915] RSP: 002b:00007fb0e311d108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 2975.421814][T22915] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 23:56:59 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00fe00}]) 23:56:59 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x900000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:56:59 executing program 0 (fault-call:0 fault-nth:11): syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 2975.430132][T22915] RDX: 0000000020ffc000 RSI: 0000000020000080 RDI: 0000000000006b67 [ 2975.438849][T22915] RBP: 0000000020000080 R08: 0000000000000000 R09: 0000000000000000 [ 2975.447214][T22915] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2975.455489][T22915] R13: 0000000020ffc000 R14: 0000000000000000 R15: 0000000020ffc000 [ 2975.464351][T22915] socket: no more sockets [ 2976.198142][T22887] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2976.207311][T22887] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2976.253273][T22887] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2976.261932][T22887] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2976.275400][T22887] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2976.284438][T22887] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2976.468224][T22887] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2976.477287][T22887] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2976.517546][T22887] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2976.526592][T22887] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2976.562059][T22887] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2976.570337][T22887] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2976.619549][T22887] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2976.628058][T22887] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2976.680946][T22887] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2976.689618][T22887] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2976.725541][T22887] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2976.733720][T22887] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2976.846555][T22925] FAULT_INJECTION: forcing a failure. [ 2976.846555][T22925] name failslab, interval 1, probability 0, space 0, times 0 [ 2976.859926][T22925] CPU: 0 PID: 22925 Comm: syz-executor.0 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 2976.871023][T22925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2976.881498][T22925] Call Trace: [ 2976.884879][T22925] dump_stack+0x137/0x19d [ 2976.889456][T22925] should_fail+0x23c/0x250 [ 2976.893909][T22925] ? security_inode_alloc+0x30/0x180 [ 2976.899610][T22925] __should_failslab+0x81/0x90 [ 2976.905028][T22925] should_failslab+0x5/0x20 [ 2976.909890][T22925] kmem_cache_alloc+0x46/0x2f0 [ 2976.914674][T22925] security_inode_alloc+0x30/0x180 [ 2976.919845][T22925] inode_init_always+0x20b/0x420 [ 2976.925424][T22925] ? sockfs_init_fs_context+0x70/0x70 [ 2976.930922][T22925] new_inode_pseudo+0x73/0x1c0 [ 2976.935709][T22925] __sock_create+0x122/0x4f0 [ 2976.940508][T22925] ? should_fail+0xd6/0x250 [ 2976.945202][T22925] sock_create_kern+0x34/0x40 [ 2976.950011][T22925] io_uring_create+0x15e5/0x18d0 [ 2976.955099][T22925] ? should_fail+0xd6/0x250 [ 2976.959684][T22925] __x64_sys_io_uring_setup+0xe1/0x120 [ 2976.965231][T22925] do_syscall_64+0x4a/0x90 [ 2976.974531][T22925] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2976.980622][T22925] RIP: 0033:0x4665f9 [ 2976.984565][T22925] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2977.005811][T22925] RSP: 002b:00007fb0e311d108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 2977.014690][T22925] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 [ 2977.024250][T22925] RDX: 0000000020ffc000 RSI: 0000000020000080 RDI: 0000000000006b67 [ 2977.033211][T22925] RBP: 0000000020000080 R08: 0000000000000000 R09: 0000000000000000 [ 2977.041912][T22925] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2977.052273][T22925] R13: 0000000020ffc000 R14: 0000000000000000 R15: 0000000020ffc000 [ 2977.061361][T22925] socket: no more sockets [ 2977.183850][T22887] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2977.194659][T22887] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2977.236122][T22887] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2977.244799][T22887] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 23:57:01 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:01 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x406}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:01 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00ff00}]) 23:57:01 executing program 0 (fault-call:0 fault-nth:12): syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:01 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:01 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00ff01}]) 23:57:01 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x604}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2978.058052][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2978.066291][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2978.111795][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2978.120555][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2978.163265][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2978.172860][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2978.285217][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2978.293612][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2978.354643][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2978.362889][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2978.418404][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2978.426972][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2978.487017][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2978.495476][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2978.555425][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2978.563536][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2978.623347][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2978.633275][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2978.789508][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2978.798353][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2978.825417][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 23:57:03 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:03 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x700}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2978.838194][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2978.861518][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2978.870536][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 23:57:03 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00ff07}]) [ 2978.940750][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2978.949695][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2978.993301][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2979.001892][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2979.036895][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2979.045784][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2979.082232][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2979.090770][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2979.127824][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2979.136044][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2979.170786][T22923] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2979.179457][T22923] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:03 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:03 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x2}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:03 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x900}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:03 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00ff0f}]) 23:57:03 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:03 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x4}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:04 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x7}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:04 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a00ffef}]) 23:57:04 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xa00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2981.002572][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2981.011201][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2981.109794][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2981.117915][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2981.152261][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2981.160664][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2981.460818][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2981.470119][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2981.508517][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2981.517974][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2981.555175][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2981.563210][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2981.611479][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2981.620903][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2981.675449][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2981.685645][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2981.714038][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2981.722745][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:06 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x9}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:06 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x3a000000}]) 23:57:06 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xf00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2982.023454][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2982.033795][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2982.100971][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2982.109681][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2982.166045][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2982.175058][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2982.280595][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2982.288770][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2982.344949][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2982.353214][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2982.398571][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2982.406808][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2982.428962][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2982.437386][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2982.450247][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2982.458894][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2982.471263][T22967] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2982.480403][T22967] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:07 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xb00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:07 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:07 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0xf}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:07 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x40000000}]) 23:57:07 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x2000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:07 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x10}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:07 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x7ffff000}]) 23:57:07 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x2100}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:07 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x88}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:07 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x204}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:07 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0xfeffffff}]) [ 2983.713221][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2983.721971][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2983.740495][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2983.749867][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2983.762747][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2983.771346][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2983.807419][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2983.815859][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2983.829298][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2983.841697][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2983.854683][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2983.863820][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2983.877540][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2983.886657][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2983.900646][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2983.909812][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2983.927253][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2983.936606][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:08 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x3f00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 2984.010973][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2984.019339][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2984.037505][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2984.045801][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2984.063676][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2984.072259][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2984.090467][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2984.098629][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2984.111292][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2984.119820][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2984.132445][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2984.140906][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2984.153701][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2984.162067][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2984.175403][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2984.183939][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2984.196285][T23010] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2984.204335][T23010] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:15 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x376}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:16 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:16 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0xffffffffffffffff}]) 23:57:18 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x4000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:20 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:20 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x2}]) 23:57:20 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x402}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 2996.090141][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.099385][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2996.115834][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.124555][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2996.136499][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.145030][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2996.173594][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.181920][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2996.193597][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.202369][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2996.214446][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.222629][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2996.235457][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.243475][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2996.257166][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.265545][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2996.277732][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.286004][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2996.414168][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.422785][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2996.471722][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.479883][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2996.495694][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.504484][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2996.530087][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.538143][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2996.557755][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.566055][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2996.580374][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.588950][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2996.603618][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.612287][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2996.669921][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.678322][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2996.692152][T23046] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2996.700783][T23046] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:21 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x3}]) 23:57:21 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xd00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:21 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x4200}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:21 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x406}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 2997.669355][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2997.677688][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2997.702238][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2997.710722][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2997.723096][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2997.731359][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2997.770214][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2997.778344][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2997.791178][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2997.799438][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2997.811795][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2997.820173][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2997.834254][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2997.844582][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2997.858557][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2997.867391][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2997.879989][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2997.888181][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2998.122275][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.131443][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2998.145094][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.153294][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2998.166178][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.174374][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2998.190341][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.198556][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2998.210944][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.219557][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2998.232828][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.241471][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2998.255604][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.263879][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2998.276948][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.285430][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2998.300760][T23053] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.309500][T23053] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2998.781752][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.790980][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2998.809550][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.818587][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2998.833179][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.842534][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2998.875490][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.884606][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2998.898943][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.908330][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2998.921096][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.929562][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2998.943899][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.952045][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2998.965781][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.974728][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2998.988305][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2998.996900][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 2999.057746][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2999.066417][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 2999.080840][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2999.089060][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 2999.102346][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2999.111114][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 2999.129264][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2999.138055][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 2999.153675][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2999.162173][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 2999.175073][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2999.183732][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 2999.196347][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2999.204835][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 2999.218370][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2999.226943][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 2999.239336][T23064] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 2999.247515][T23064] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:25 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x7403}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:26 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xe00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:26 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x604}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:26 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x4}]) 23:57:26 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:26 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x8a00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:26 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x700}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:26 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x5}]) [ 3003.062053][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3003.071637][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3003.116718][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3003.124985][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3003.137525][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3003.145859][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3003.407655][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3003.416330][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3003.457628][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3003.465693][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3003.479599][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3003.487834][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3003.534991][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3003.543280][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3003.596573][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3003.605256][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3003.632955][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3003.643079][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:27 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x900}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:27 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x6}]) 23:57:27 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xfeff}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 3003.881762][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3003.891313][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3003.932014][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3003.940343][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3003.968948][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3003.978005][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3004.028739][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3004.037417][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3004.072668][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3004.081072][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3004.115710][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3004.123892][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3004.160040][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3004.168650][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3004.204262][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3004.212770][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3004.249493][T23080] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3004.257849][T23080] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:28 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0xf00}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:28 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x7}]) 23:57:28 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x2000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:28 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xfffe}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:29 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:29 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x4000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:29 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x8}]) 23:57:29 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x40000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:29 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:29 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x5500}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:29 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x9}]) 23:57:29 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x60ff}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:29 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x7603}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:29 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x7f00}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:29 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xa}]) [ 3005.678831][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3005.687443][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3005.704824][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3005.712958][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3005.725468][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3005.733684][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3005.784753][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3005.793217][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3005.806022][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3005.814233][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3005.826982][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3005.836153][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3005.848701][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3005.856905][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3005.871380][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3005.879682][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3005.891850][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3005.900286][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3005.984382][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3005.992539][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3006.005609][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3006.014166][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3006.028281][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3006.036838][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3006.054200][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3006.062930][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3006.077065][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3006.085287][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3006.099351][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3006.107939][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3006.123033][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3006.131436][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3006.144814][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3006.152944][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3006.166453][T23137] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3006.174507][T23137] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:30 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xc}]) 23:57:30 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:30 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x1000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:30 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:30 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x8800}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:30 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xd}]) 23:57:30 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x2000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:31 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x9700}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 3007.368659][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.377285][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3007.394310][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.402587][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3007.414945][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.423531][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3007.464266][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.472737][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3007.485097][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.493308][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3007.505163][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.513276][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3007.525979][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.534362][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3007.547963][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.556927][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3007.571615][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.581019][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3007.635639][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.644446][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3007.657654][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.665990][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3007.678225][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.687127][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3007.702760][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.711017][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3007.723634][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.731841][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3007.744725][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.753412][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3007.766192][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.774320][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3007.786880][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.794990][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3007.808534][T23164] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3007.816946][T23164] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:33 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xe}]) 23:57:33 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x2040000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:33 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 3010.315429][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.323880][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3010.341503][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.349587][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 23:57:34 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x6040000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:34 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x104000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:34 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:34 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x10}]) [ 3010.376445][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.385328][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3010.417202][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.425884][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3010.439146][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.447381][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3010.459453][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.467784][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3010.480799][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.488898][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3010.502688][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.511356][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3010.524158][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.532343][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3010.633256][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.641508][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3010.657501][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.666328][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3010.681003][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.689233][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3010.741023][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.749403][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3010.762639][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.770972][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3010.783233][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.791562][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3010.804355][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.812711][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3010.827087][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.843523][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3010.861919][T23190] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3010.870973][T23190] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3011.430394][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.439271][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3011.456031][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.464188][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3011.476549][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.484867][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3011.515513][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.524491][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3011.537085][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.545388][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3011.558977][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.568520][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3011.584265][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.592969][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3011.606611][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.615186][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3011.627471][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.635760][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:35 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:35 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x105400}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:35 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x7000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 3011.683478][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.692035][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3011.706094][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.714628][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 23:57:35 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x12}]) [ 3011.744081][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.753570][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3011.774382][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.782663][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3011.795333][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.803458][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3011.815530][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.824186][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3011.840365][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.848883][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3011.864004][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.873312][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3011.886151][T23199] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3011.894575][T23199] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:36 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x200000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:36 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:36 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x8000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:36 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x63}]) [ 3012.867717][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3012.876474][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3012.916858][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3012.925355][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3012.937013][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3012.945335][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 23:57:37 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000040)=""/16, 0x10}], 0x1, 0xd9f, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f000004e8c0)={0x0, 0x0, "4671874e62000658aecbd80cbaafd26501ee824c7105f35a679dd05a38f6746951d970dacf832549868aebe71ba20f8ff9107401f7d79cb4fb958b2861ffe9677b2c8e6332f2fe60c7c6ab8d6d7900f4f5341995bde4bb2aab6a95a978c78d579c1d23f170f18425d805670218d58255a0a5cdff93c61fe2ae4a29633728e1eca55d307b89659dc31484d3b3a76569458e490db22092dd11d76b359b40f2145a29e44657918d74733c78333e1bc4b03ed32da83c5643675d8908375253aaa0d5bfcee5f3bdbeaa5757bf163e1f87fc95696b27b5619f083edf35cc34968f911ef410da8046e037141308abf73f472f0b7676f9b35f61260be37cd59fba4eb03a", "dd631d6c00016ba87bb9bf8f37040239491643dd51a3fa4c426edbd6ab0d120fb5b7eac3dba8eed8a55df640438d90445c5c60a078876aaf826f2dffa1d6057043fc626cc1d11daae7da93385dfb1b149b7e01f8b65852bb13f4329c22ca06c8ea8fac700d916ab539e3ef26da49ec64f28dc0fa0c1c6dd0c7673d1776d2539ef731a5a4b1cc0a90c5faf0f9035f7e4ca2ae0ec50e0f651756bc09359f314d4f80aa1f9d8b1e7830b9dc0581954e50de51e263f7f32ea2f7f072d7c6fdb9fcf71eeb27d526e5db98f3df8a6cc85757d6c1fea1dfda7d332deda9f8f58b16129a37dbcace7d76831294a7706b3fd1d86d54c1ddfff82bb765732e4c69bfd4aca67b39fd4fc0272713014075994e70184d20c55d3709baa9b3c04b12c1f9293b5c1d916532d34f7c5825a46498f3562d0b3f6d8f028e42bfe46ad6dca03d5ad4fb819ddb30e8d018b56d408798530223b324bb0d3835a5f2481883878c7ecf8369769c8559a781315e76c2c6989e114c5239ef8207d8ab62c4ee30575877b4b9c63476b20981970755eb6976cd1086465595cecd59a0475833f2c4e4587430eee27f95ac6e8dd4bbf284cfbcfd2ad34be20d65654948f6b421a981695d1eb372424e436689d0f995a510c5f52d66a287fc8ae50b0983700f3ed01bc177112687d25f269c65f35f50e7d553133d83d423c4bbc9b9dca6e8ac1e5386bcca9524172fffe236503b705ef68137df8b3dec7ce9fcbea15bd8c95e7966abe14b581c550b0bde70b48ec8d0e8d34848a82a6551f1bdbc9aa412081cb0efb435838c0331ae511fa4a31697eeb723b206e717b453875be3c3e71465a6b76fbbf1c2275713001741280e39a04d6e02d712bf908108cd7fba79d7fca2ce73cd529971a6b021020a23b35dafc6830722e4709be608f9152394162b91eb4689c4186818a416f78952f73a8f2bbdf13f0d85fd415490448a60808e63c7df90cee7b76cdfc8319b3572bad673dbb3abed0598a744a60b1765d00e3d72a53dc95c0c4ddd6bffba407e2d2f89bdd68e00d539c015c4d78f722a816eebaa755876a7a4df88b36fd124a36eda6744fa1f1966fa59085119e503691162da297fde674e6958fddc4439e39bd52494c741b3625159f117aaa2aff3160aacbe4a31c2f6be92cb3dd3be3d0089cc888b171a951bb0585f2075546570856f2f1f9ccecefc61e6701bc5bcc45acec15932840e3b78a7f8e5553f323fa433c6747931c8e3530eba14990ce8ccde255ee5ec4c2679faf31831eb8cc8d4bb606f9a2641a06fabeedefe84adf5ba047ab3ffc5fffba9a1b4ca4cb1bb1ac7ca1b44602f6f341e0609c294117c10d8f9bb26e6da35e4f83d0691ae500bf11584d525f4c1af1f3d78991d5cf11ff95fd14bdb8318be0aac92b5c5831beef24510d64cfb892a042ec1f29a1d198af5c672f2bf2ddc787e304bfb7761ddb386bab43109d424b03bae40c2e764b626048b2852ac78ecaa23148377145e85647ecb366e80e12e173750f2326d1a6829d02a82533ca612b1a982aacb11a509c1a8e101bc5286653100c6b36e371429b59a6b947067a5805a0d2dc47d99c5fb58b139ae568d62b40b4d6db5de52d931ad5b884baf12362808fa98cb275602bdc4723abe9be2f889ff54432aeaa84eb4788ffa820d80143d3dd88e27cea0e4e69b6248425f5d76e6da65a2601070bb0ed9122ec8e15d6c6e6810828c08e1d553a2fe19a579769fbdd7d8b26c0a582a20f6bb12178ef9d8527076a3449a7e8ef7d727f275f5e0f2aea9aa503657ce2e9bbf05e9ce62ce878bb4e7f56ece77975f6d1a3a50d3724e90a4580eff32b2e441a5e422f026ebe048ff63e69c465a8fa85d321cf1f861eaeb91e8ed708fc5f2ca841fbf4a649e0a9e04a537252bf383de3fb9425403c12850870a202a4eab9a587893cc856f96bacb6050192dadc74066429b9dd4a5d242cfff39747b2dd597a13f9295d4847b2129f6beafbf0ecf6a84d45d4f9f555cd0815acbf1575df293d67b0173c38b246d10a4946ff48249c8c408dd0080f23c9fb10c0bd5f00d3fbba9a260bc1704b990fbf415dd4959f6c5fa4118b7618e56d69e364c6490461d7be13c6fdc3e045e63ece350d3a6843c44b7e9ca77738728201af2e021912399023bed912c6d28f4a5f1aa524b0401a47fe9b687cf0513c2fdf7bfd2eeff316389146f4614f576b94c83759c951590e102ef32ba68f8151aad8f673cdc80baa34cafa2bd0367cc7b79a8f53e7ba33613e1e0bcc9309696602735a233672abf480c0dd4062b3414319ea1ceb8551ba1b0884ddf3347fe8f44bb6a060f91dc15127e676bcec3ef811ebfecf314bcec908c5bfc200bc8035565a9396146b0e22c28389354fedfa2dcfc6e822bdd75bc6903fc557f5d022f16118a9f106b47de2c97737d5e747170e897bdfabe39d0528ad33a145bdb0e13a5666e9b4861cbbc9c33287256c9646773c47ede99cf178be649da3f54762d7820fce86241277bbd4ed3f0bc47e34d85f39b665df38107f031077f9e9e36d48bca9fda7f564cb35c74bcb258fce44fb16280316608425ff6e106b72b1288eb8d6c1676245c2808a06ebb01f9ab45d2f7f1ee6c1d050a8176fe489a23d79432f947be2a23534575d27164afa1e6a59892641eebdc1c98a135a157a77a280e56fea762c242f9ddb788ce85f12e3202236dea6f8cbaceedabd736a4bbdb9987c0bc506b0950d4e0844cb28256df1be0552ca16004aedf986cdcd5b007784c9752e263044cf68d4b07c468035c74e84ce272c5d0dceaef2a98f5a56cfeb619fb4917432a67bd3333b5fe2821757aa6f0b0928fc790645af820da8c06b7fccfa569bac34446d9a98a27757e7a205540c73ab89c8e0c8cf6b11bfd061797f99948633fc2934d7269c872152fedb122fe5b4ed8455b9acf9534950d5339b7f471b445de07391f68b26cd2a6135ce8f39aeec7f0eccf035a742fce8ddcb273eac322b9592011095ffe269ba40f018488b503025aededb0d4769e4a7677f04e6528b5abac556216abaf0b98d3982b6b17c03c04cdb7f4e637df8ff2486ad07423e99afa398897fef4f7ab6e657a83545d999dee8d38ca14fe8f4f83bb5f936312a94b77ec8cc995a7e146c22c24e1bddb7e78cc671301a61bafe267a874f0513ba72f4a71b6813be3f98106ad0724d36985ddebca3502165ad1ef20458a831d96856ef405f73801f2aa0bda4d02c49a0bfaae4745b632c771b61f4790787acf9fb242f650c9272d1df73e8f47957a94f56d0ab84bd67f8e0bac3a1bfce969020cfd0c6ff33fb3f6e33160f032407bac0dbed51bb9a38618b838caf8b9f0ed9b3d6ac766e8ecd4314481efec1d60cd6ebace11a7acf5866ffde10616cdac8fa022be898fcdf9c86c07202afbbe332a494b4a78670d2c86c91eed0e017ad950567da0acc970e42e184260e83060046bc91f69bb92eb28f5b503fe79216dae15a62bf2cb96364c62ed67440522f5200f3549b841dedb0b77a5b23f837b6483cc5ce6ead47673c9d5449ff8666b352e651e833ecb9d34e0433c0ad0a5583d52c2006cf145993b363e53eb3b553cd2c7e0623976db9b9665fbe7e08a17e7affe0a3ce7a24d91ab49022854bcbde4af93d4efb7ec95b4bc20a6111c47903435b39330aef1b722fc753e3cc13f6138441e5ee4a8fdad9ffebbd01750dc523a7c39f7777cb32790dffee960c2435f3f76331143dc04a47f0376f96127f59dedf334f8c707023150694042f9d8c6541c46bb5db19f7d0c61d4289497023bb6374ef8ea1ebbff8f576f474cef7c8ac0b514d7c244f06c679cb53fe7888d722e750d1377568d422215b2fd3155b32a9a1e316e329d5b2ef4268423fc3663068e7c99e56e745eff63ed343e212254bdd857148feee31c22eea22e68af0d232febafd606a389081e380425ccdf3734b53e0ad3c0a620990ae0d2d2054a3de33abe119c662bf30c85eec7275ffaa2c9274d430c91bbe6ba5f6fb4a4adef1dd737236658a0e51097e736076b3d5c890a9e4e3d3b5987fdb58bdc8158ff8c980db15fa6c3c73cf46917f1b39637bdc2c25bb69f3d41d303712bfa6c4611c55a16e18aefb7f103b1f61efbf5492aa317596685e4836dc9ed3512bb7d27e9ce4ea512e15105b0be6aafaced00a0871e77c8632be877c9a5f7dc911b49faf55f0427468379a50273ffaeb8d34f898a702c0a7d5f4bd6db8132259eeacf0a396c2f36ba4168cac10f555ce5bdc1204c9003578d014dafc42fbabed666711abb073f1063be533164e66c83c8ec5e865c80f26d0b604cb342d0c3f2c3b0242d1a81e236add6acb9e966d11264a0161e34f3b281e95db431ab9c75ab4d63cad39f04ace24ca2b2c6d8eda2d08fd6e27e7af18f163ea25994bebe684e62846be8ae7a6659aff78b8ffe59f4eefa2518b8975377d363ed326ea32a766b45b28818921e9d4dd942669d487dbaa6bfbca6b5493a1917d3c539838ce0ba9d8cd3b716ef3cc05fe99aba98169d77dfec35b8f365258f8d074b266f639466675d4bebbb709f6f531b9ea8216e4121ab0421fa47e45522478685f9adb6454f045338d7c583ec9822a76b527fcea2893456ef540f4d3244f58ad687242873aed3684691e9b4e4923e0dc54f4599e2eaba4e2dd6b866aa83cad018d22af3a9d7d8eb65a29e6ee50e649b806d5f2b985d0515d862225f6f350cd0cc081aeb87c2ff078b25391b6b57b90f65f79aa020fa740f3b9708f4c25869bba4b742b5bc0ac4bf31044b2d8714bf02ee795f3747c6878767a937c7e6ae1b98baca4b351ef2fececcf71e03d436b2927589999a9736fb590dd9e71235e7c49a1d4ff8592e381915736153a56612503b3a1ed9689c77a1d3933ff57278465ead26d5141f145302bc6e8db77ffd3341edae0eeeac57fe7e5910e222793261ca0abbdceaf572b34da570670c0d3e6c04d2763debb0673c6eff498101699a45fea78beec048bcd89cf0d4163dde9cd857d7dbdb37e292225bc068e719082cadf66af63c19eb91bf7cd59828cb186bd1c94d49bed59df3578fac3bee2c0e9aef8bc3e75748e05dbdfcf0e4e39b8e8ea6ef4d3997ca2a41e3a7bdc8ab72c91ec2e5ba5d14bbc95adfd0db8055520f34d2bc270ed51c282140d3b11db861cc20f41f1f4ea1bb2ffa3a8a37ac94c4b8a91c5bf24474b4b20731579fe5eb2c11b5551f1046a634350f43845e23e079ebbf1834674de327e5fcffc8eff8f1db45347d51f394cedc98d1ebda253f7bee6fd8d2f65538b6d46d14024d28d426240bf7d1972e1f1cb21923c24330e1297540167f3b0d71592467af18720a4c26b046265540c90cf9cacc6a04c841b65f713e2af92e986124055ec09bc5d1a8c77c63"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001640)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) socketpair(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, 0x0) sendmsg$NLBL_CIPSOV4_C_REMOVE(r3, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f0000001840)=ANY=[@ANYRES32, @ANYRES32=r2, @ANYRESOCT, @ANYRES32=r1, @ANYRES64, @ANYRESHEX], 0x3}, 0x1, 0x0, 0x0, 0x4}, 0x40025) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000056b80)={0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r1}], 0x0, "b34c00ca89e6ff"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f000005b680)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f00000004c0)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f000004e8c0)={r6, r5, "4671874e62000658aecbd80cbaafd26501ee824c7105f35a679dd05a38f6746951d970dacf832549868aebe71ba20f8ff9107401f7d79cb4fb958b2861ffe9677b2c8e6332f2fe60c7c6ab8d6d7900f4f5341995bde4bb2aab6a95a978c78d579c1d23f170f18425d805670218d58255a0a5cdff93c61fe2ae4a29633728e1eca55d307b89659dc31484d3b3a76569458e490db22092dd11d76b359b40f2145a29e44657918d74733c78333e1bc4b03ed32da83c5643675d8908375253aaa0d5bfcee5f3bdbeaa5757bf163e1f87fc95696b27b5619f083edf35cc34968f911ef410da8046e037141308abf73f472f0b7676f9b35f61260be37cd59fba4eb03a", "dd631d6c00016ba87bb9bf8f37040239491643dd51a3fa4c426edbd6ab0d120fb5b7eac3dba8eed8a55df640438d90445c5c60a078876aaf826f2dffa1d6057043fc626cc1d11daae7da93385dfb1b149b7e01f8b65852bb13f4329c22ca06c8ea8fac700d916ab539e3ef26da49ec64f28dc0fa0c1c6dd0c7673d1776d2539ef731a5a4b1cc0a90c5faf0f9035f7e4ca2ae0ec50e0f651756bc09359f314d4f80aa1f9d8b1e7830b9dc0581954e50de51e263f7f32ea2f7f072d7c6fdb9fcf71eeb27d526e5db98f3df8a6cc85757d6c1fea1dfda7d332deda9f8f58b16129a37dbcace7d76831294a7706b3fd1d86d54c1ddfff82bb765732e4c69bfd4aca67b39fd4fc0272713014075994e70184d20c55d3709baa9b3c04b12c1f9293b5c1d916532d34f7c5825a46498f3562d0b3f6d8f028e42bfe46ad6dca03d5ad4fb819ddb30e8d018b56d408798530223b324bb0d3835a5f2481883878c7ecf8369769c8559a781315e76c2c6989e114c5239ef8207d8ab62c4ee30575877b4b9c63476b20981970755eb6976cd1086465595cecd59a0475833f2c4e4587430eee27f95ac6e8dd4bbf284cfbcfd2ad34be20d65654948f6b421a981695d1eb372424e436689d0f995a510c5f52d66a287fc8ae50b0983700f3ed01bc177112687d25f269c65f35f50e7d553133d83d423c4bbc9b9dca6e8ac1e5386bcca9524172fffe236503b705ef68137df8b3dec7ce9fcbea15bd8c95e7966abe14b581c550b0bde70b48ec8d0e8d34848a82a6551f1bdbc9aa412081cb0efb435838c0331ae511fa4a31697eeb723b206e717b453875be3c3e71465a6b76fbbf1c2275713001741280e39a04d6e02d712bf908108cd7fba79d7fca2ce73cd529971a6b021020a23b35dafc6830722e4709be608f9152394162b91eb4689c4186818a416f78952f73a8f2bbdf13f0d85fd415490448a60808e63c7df90cee7b76cdfc8319b3572bad673dbb3abed0598a744a60b1765d00e3d72a53dc95c0c4ddd6bffba407e2d2f89bdd68e00d539c015c4d78f722a816eebaa755876a7a4df88b36fd124a36eda6744fa1f1966fa59085119e503691162da297fde674e6958fddc4439e39bd52494c741b3625159f117aaa2aff3160aacbe4a31c2f6be92cb3dd3be3d0089cc888b171a951bb0585f2075546570856f2f1f9ccecefc61e6701bc5bcc45acec15932840e3b78a7f8e5553f323fa433c6747931c8e3530eba14990ce8ccde255ee5ec4c2679faf31831eb8cc8d4bb606f9a2641a06fabeedefe84adf5ba047ab3ffc5fffba9a1b4ca4cb1bb1ac7ca1b44602f6f341e0609c294117c10d8f9bb26e6da35e4f83d0691ae500bf11584d525f4c1af1f3d78991d5cf11ff95fd14bdb8318be0aac92b5c5831beef24510d64cfb892a042ec1f29a1d198af5c672f2bf2ddc787e304bfb7761ddb386bab43109d424b03bae40c2e764b626048b2852ac78ecaa23148377145e85647ecb366e80e12e173750f2326d1a6829d02a82533ca612b1a982aacb11a509c1a8e101bc5286653100c6b36e371429b59a6b947067a5805a0d2dc47d99c5fb58b139ae568d62b40b4d6db5de52d931ad5b884baf12362808fa98cb275602bdc4723abe9be2f889ff54432aeaa84eb4788ffa820d80143d3dd88e27cea0e4e69b6248425f5d76e6da65a2601070bb0ed9122ec8e15d6c6e6810828c08e1d553a2fe19a579769fbdd7d8b26c0a582a20f6bb12178ef9d8527076a3449a7e8ef7d727f275f5e0f2aea9aa503657ce2e9bbf05e9ce62ce878bb4e7f56ece77975f6d1a3a50d3724e90a4580eff32b2e441a5e422f026ebe048ff63e69c465a8fa85d321cf1f861eaeb91e8ed708fc5f2ca841fbf4a649e0a9e04a537252bf383de3fb9425403c12850870a202a4eab9a587893cc856f96bacb6050192dadc74066429b9dd4a5d242cfff39747b2dd597a13f9295d4847b2129f6beafbf0ecf6a84d45d4f9f555cd0815acbf1575df293d67b0173c38b246d10a4946ff48249c8c408dd0080f23c9fb10c0bd5f00d3fbba9a260bc1704b990fbf415dd4959f6c5fa4118b7618e56d69e364c6490461d7be13c6fdc3e045e63ece350d3a6843c44b7e9ca77738728201af2e021912399023bed912c6d28f4a5f1aa524b0401a47fe9b687cf0513c2fdf7bfd2eeff316389146f4614f576b94c83759c951590e102ef32ba68f8151aad8f673cdc80baa34cafa2bd0367cc7b79a8f53e7ba33613e1e0bcc9309696602735a233672abf480c0dd4062b3414319ea1ceb8551ba1b0884ddf3347fe8f44bb6a060f91dc15127e676bcec3ef811ebfecf314bcec908c5bfc200bc8035565a9396146b0e22c28389354fedfa2dcfc6e822bdd75bc6903fc557f5d022f16118a9f106b47de2c97737d5e747170e897bdfabe39d0528ad33a145bdb0e13a5666e9b4861cbbc9c33287256c9646773c47ede99cf178be649da3f54762d7820fce86241277bbd4ed3f0bc47e34d85f39b665df38107f031077f9e9e36d48bca9fda7f564cb35c74bcb258fce44fb16280316608425ff6e106b72b1288eb8d6c1676245c2808a06ebb01f9ab45d2f7f1ee6c1d050a8176fe489a23d79432f947be2a23534575d27164afa1e6a59892641eebdc1c98a135a157a77a280e56fea762c242f9ddb788ce85f12e3202236dea6f8cbaceedabd736a4bbdb9987c0bc506b0950d4e0844cb28256df1be0552ca16004aedf986cdcd5b007784c9752e263044cf68d4b07c468035c74e84ce272c5d0dceaef2a98f5a56cfeb619fb4917432a67bd3333b5fe2821757aa6f0b0928fc790645af820da8c06b7fccfa569bac34446d9a98a27757e7a205540c73ab89c8e0c8cf6b11bfd061797f99948633fc2934d7269c872152fedb122fe5b4ed8455b9acf9534950d5339b7f471b445de07391f68b26cd2a6135ce8f39aeec7f0eccf035a742fce8ddcb273eac322b9592011095ffe269ba40f018488b503025aededb0d4769e4a7677f04e6528b5abac556216abaf0b98d3982b6b17c03c04cdb7f4e637df8ff2486ad07423e99afa398897fef4f7ab6e657a83545d999dee8d38ca14fe8f4f83bb5f936312a94b77ec8cc995a7e146c22c24e1bddb7e78cc671301a61bafe267a874f0513ba72f4a71b6813be3f98106ad0724d36985ddebca3502165ad1ef20458a831d96856ef405f73801f2aa0bda4d02c49a0bfaae4745b632c771b61f4790787acf9fb242f650c9272d1df73e8f47957a94f56d0ab84bd67f8e0bac3a1bfce969020cfd0c6ff33fb3f6e33160f032407bac0dbed51bb9a38618b838caf8b9f0ed9b3d6ac766e8ecd4314481efec1d60cd6ebace11a7acf5866ffde10616cdac8fa022be898fcdf9c86c07202afbbe332a494b4a78670d2c86c91eed0e017ad950567da0acc970e42e184260e83060046bc91f69bb92eb28f5b503fe79216dae15a62bf2cb96364c62ed67440522f5200f3549b841dedb0b77a5b23f837b6483cc5ce6ead47673c9d5449ff8666b352e651e833ecb9d34e0433c0ad0a5583d52c2006cf145993b363e53eb3b553cd2c7e0623976db9b9665fbe7e08a17e7affe0a3ce7a24d91ab49022854bcbde4af93d4efb7ec95b4bc20a6111c47903435b39330aef1b722fc753e3cc13f6138441e5ee4a8fdad9ffebbd01750dc523a7c39f7777cb32790dffee960c2435f3f76331143dc04a47f0376f96127f59dedf334f8c707023150694042f9d8c6541c46bb5db19f7d0c61d4289497023bb6374ef8ea1ebbff8f576f474cef7c8ac0b514d7c244f06c679cb53fe7888d722e750d1377568d422215b2fd3155b32a9a1e316e329d5b2ef4268423fc3663068e7c99e56e745eff63ed343e212254bdd857148feee31c22eea22e68af0d232febafd606a389081e380425ccdf3734b53e0ad3c0a620990ae0d2d2054a3de33abe119c662bf30c85eec7275ffaa2c9274d430c91bbe6ba5f6fb4a4adef1dd737236658a0e51097e736076b3d5c890a9e4e3d3b5987fdb58bdc8158ff8c980db15fa6c3c73cf46917f1b39637bdc2c25bb69f3d41d303712bfa6c4611c55a16e18aefb7f103b1f61efbf5492aa317596685e4836dc9ed3512bb7d27e9ce4ea512e15105b0be6aafaced00a0871e77c8632be877c9a5f7dc911b49faf55f0427468379a50273ffaeb8d34f898a702c0a7d5f4bd6db8132259eeacf0a396c2f36ba4168cac10f555ce5bdc1204c9003578d014dafc42fbabed666711abb073f1063be533164e66c83c8ec5e865c80f26d0b604cb342d0c3f2c3b0242d1a81e236add6acb9e966d11264a0161e34f3b281e95db431ab9c75ab4d63cad39f04ace24ca2b2c6d8eda2d08fd6e27e7af18f163ea25994bebe684e62846be8ae7a6659aff78b8ffe59f4eefa2518b8975377d363ed326ea32a766b45b28818921e9d4dd942669d487dbaa6bfbca6b5493a1917d3c539838ce0ba9d8cd3b716ef3cc05fe99aba98169d77dfec35b8f365258f8d074b266f639466675d4bebbb709f6f531b9ea8216e4121ab0421fa47e45522478685f9adb6454f045338d7c583ec9822a76b527fcea2893456ef540f4d3244f58ad687242873aed3684691e9b4e4923e0dc54f4599e2eaba4e2dd6b866aa83cad018d22af3a9d7d8eb65a29e6ee50e649b806d5f2b985d0515d862225f6f350cd0cc081aeb87c2ff078b25391b6b57b90f65f79aa020fa740f3b9708f4c25869bba4b742b5bc0ac4bf31044b2d8714bf02ee795f3747c6878767a937c7e6ae1b98baca4b351ef2fececcf71e03d436b2927589999a9736fb590dd9e71235e7c49a1d4ff8592e381915736153a56612503b3a1ed9689c77a1d3933ff57278465ead26d5141f145302bc6e8db77ffd3341edae0eeeac57fe7e5910e222793261ca0abbdceaf572b34da570670c0d3e6c04d2763debb0673c6eff498101699a45fea78beec048bcd89cf0d4163dde9cd857d7dbdb37e292225bc068e719082cadf66af63c19eb91bf7cd59828cb186bd1c94d49bed59df3578fac3bee2c0e9aef8bc3e75748e05dbdfcf0e4e39b8e8ea6ef4d3997ca2a41e3a7bdc8ab72c91ec2e5ba5d14bbc95adfd0db8055520f34d2bc270ed51c282140d3b11db861cc20f41f1f4ea1bb2ffa3a8a37ac94c4b8a91c5bf24474b4b20731579fe5eb2c11b5551f1046a634350f43845e23e079ebbf1834674de327e5fcffc8eff8f1db45347d51f394cedc98d1ebda253f7bee6fd8d2f65538b6d46d14024d28d426240bf7d1972e1f1cb21923c24330e1297540167f3b0d71592467af18720a4c26b046265540c90cf9cacc6a04c841b65f713e2af92e986124055ec09bc5d1a8c77c63"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001640)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) socketpair(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r9, 0x8914, 0x0) sendmsg$NLBL_CIPSOV4_C_REMOVE(r9, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f0000001840)=ANY=[@ANYRES32, @ANYRES32=r8, @ANYRESOCT, @ANYRES32=r7, @ANYRES64, @ANYRESHEX], 0x3}, 0x1, 0x0, 0x0, 0x4}, 0x40025) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000056b80)={0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r7}], 0x0, "b34c00ca89e6ff"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f000005b880)={0x5, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r1}, {0x0, r4}, {r5}, {}, {0x0, r7}], 0x7, "465cf99e6e9547"}) [ 3013.112530][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.121235][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3013.136612][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.144623][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3013.156423][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.165235][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3013.185385][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.193741][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3013.216958][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.225270][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3013.237705][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.245992][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:37 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x400000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:37 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$BTRFS_IOC_QUOTA_CTL(r1, 0xc0109428, &(0x7f0000000040)={0x2}) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_setup(0x20a8, &(0x7f0000000080)={0x0, 0x2e2b, 0x20, 0x2, 0x15d}, &(0x7f000039d000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:57:37 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x9000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:37 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x82}]) [ 3013.410337][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.419188][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3013.439113][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.447552][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3013.460372][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.470545][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3013.501781][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.510018][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3013.522309][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.530701][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3013.542734][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.550777][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3013.563214][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.571467][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3013.583955][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.592264][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3013.604494][T23213] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3013.613705][T23213] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:38 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xa000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:38 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xef}]) 23:57:38 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x401000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:38 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 3014.460128][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3014.469337][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3014.510824][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3014.519784][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3014.532377][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3014.541162][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3014.684781][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3014.693644][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3014.709068][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3014.717690][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3014.731015][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3014.739390][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3014.760181][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3014.769164][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3014.791977][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3014.800429][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3014.813264][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3014.822078][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3015.000107][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.008933][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3015.024096][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.032949][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3015.045388][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.054384][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3015.085690][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.094158][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3015.106405][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.114910][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3015.126847][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.135327][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3015.148207][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.156820][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3015.169798][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.178203][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3015.190527][T23226] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.199005][T23226] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:39 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x4af000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:39 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xf000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:39 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xf0}]) 23:57:39 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:39 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x460842, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r1, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) ioctl$BTRFS_IOC_SCRUB_CANCEL(r1, 0x941c, 0x0) preadv(r0, &(0x7f0000000280), 0x25, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) openat(r0, &(0x7f0000000040)='./file0\x00', 0x90080, 0x8a) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x8000, 0x194) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000200)="2fa043a8b797229ce1e00569040aeae83920b9a54fd2b8f0326b2f4badbfa6416df4b995fa9fc39b9505ad459178079fe4e741c8119457e621edfc049492e688241b92b5f86d5dddb8d6dbe79853434e8f804b9278d3431fd78e574a33acdb27aaf51602c6a372e609c8b6468ead60698204f93c8b918fef239469fdb252c22299254618c23b4af85d5b3666d019dc53a3e39795e943d6cb4ccf503cdf3748cbe13330290ea97c918dea555643d75d80a4fa28318cdb4e5a114f2b70c7f2f9f63fb0b9913aa8b5b276015d16c47c6a327078db60d1b15f9e25ab5e022ab72aef87c407609498a540f198d7831feeb18ea11cfd0fb7f2e708ef1b0ed232feab01") perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 3015.593121][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.601808][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3015.618461][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.626731][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3015.638872][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.647154][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3015.680792][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.689483][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3015.702148][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.710455][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3015.722250][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.730532][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3015.743445][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.751917][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3015.765243][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.773616][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3015.785718][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.793945][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3015.893004][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.901333][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3015.933205][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.941280][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3015.955648][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3015.964399][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3015.994037][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3016.003072][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3016.026342][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3016.034543][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3016.048148][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3016.057851][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3016.074058][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3016.082436][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3016.095432][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3016.104011][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3016.116670][T23258] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3016.124848][T23258] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:40 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:40 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x4fd000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:40 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x20000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:40 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xf6}]) 23:57:40 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000332000/0xb000)=nil, 0xb000, 0x4, 0x110, r0, 0xdc137000) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000040)=""/218, 0xda}], 0x1, 0xda3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) ioctl$BTRFS_IOC_LOGICAL_INO(r0, 0xc0389424, &(0x7f0000000280)={0x2, 0x50, '\x00', 0x1, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 3016.882269][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3016.890742][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3016.929379][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3016.937870][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3016.949720][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3016.958145][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3017.100692][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.109015][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3017.123671][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.131913][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3017.143714][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.151929][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3017.170756][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.179097][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3017.201797][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.209940][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3017.222084][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.230318][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:41 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x541000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:41 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xfe}]) 23:57:41 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x0, 0x4, 0x0) recvfrom$unix(r0, &(0x7f0000000040)=""/121, 0x79, 0x100, 0x0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0), 0x20, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0x44, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x9}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4800) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0xd9, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 3017.449283][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.458176][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3017.473108][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.482299][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3017.496806][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.505693][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3017.535522][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.544454][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3017.557987][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.567291][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3017.579479][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.588335][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3017.600837][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.608960][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3017.621263][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.629319][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3017.641614][T23273] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3017.649847][T23273] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:42 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:42 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x550000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:42 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x21000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:42 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x204}]) 23:57:42 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) read(r0, &(0x7f00000000c0)=""/84, 0x54) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r0, 0x5000943f, &(0x7f0000000200)={{r0}, 0x0, 0x18, @inherit={0x60, &(0x7f0000000040)={0x1, 0x3, 0x8, 0x81, {0x2f, 0x80, 0x3, 0x41, 0x1f}, [0x2, 0x7, 0x400]}}, @subvolid=0x8}) fremovexattr(0xffffffffffffffff, &(0x7f0000000140)=@known='com.apple.FinderInfo\x00') preadv(r0, &(0x7f00000000c0), 0x0, 0xd9f, 0x8) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 3018.455098][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3018.463221][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3018.505911][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3018.514304][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3018.526304][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3018.534788][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3018.679142][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3018.687493][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3018.702437][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3018.711062][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3018.723214][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3018.731563][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3018.750414][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3018.759079][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3018.781990][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3018.790265][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3018.802633][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3018.811110][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3019.030634][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3019.038974][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3019.053171][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3019.061463][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3019.078897][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3019.087123][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3019.118031][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3019.126154][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3019.139795][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3019.148264][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3019.160595][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3019.168852][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3019.181257][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3019.189696][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3019.202555][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3019.210704][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3019.223040][T23285] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3019.231513][T23285] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:43 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:43 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x970000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:43 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x3f000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:43 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x281}]) 23:57:43 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r1, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) mmap(&(0x7f000074e000/0x3000)=nil, 0x3000, 0x8, 0x4000010, r1, 0x7b36c000) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 3019.900830][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3019.910183][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3019.949469][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3019.959156][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3019.972201][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3019.980678][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3020.121301][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.130430][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3020.145784][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.154398][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3020.166874][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.176160][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3020.196082][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.204787][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3020.226945][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.235073][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3020.247844][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.257181][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:44 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0xc04a01}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:44 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x300}]) 23:57:44 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x40800}, 0x0) r4 = socket$inet6(0xa, 0x80803, 0x87) r5 = signalfd(r3, &(0x7f00000000c0)={[0x3]}, 0x8) mknodat$loop(r5, &(0x7f0000000200)='./file0\x00', 0x2, 0x1) getsockopt$inet6_opts(r4, 0x29, 0x7, &(0x7f0000000100)=""/127, &(0x7f0000000080)=0x7f) r6 = syz_io_uring_setup(0xd9d, &(0x7f0000000100), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080)=0x0, &(0x7f0000000180)) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x40800}, 0x0) syz_io_uring_submit(r7, 0x0, &(0x7f0000000240)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r5, 0x0, 0x0, 0xfdaa, 0xb, 0x1}, 0x0) r8 = syz_io_uring_setup(0x21cb, &(0x7f0000000000), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f0000000100)) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r6, 0x6, 0x400000, r9) syz_io_uring_submit(0x0, r2, &(0x7f0000000040)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x1, 0x4007, @fd=r4, 0x2, 0x0, 0x0, 0x22, 0x0, {0x0, r9}}, 0x4) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x1ff}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 3020.429489][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.438755][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3020.457736][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.468760][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3020.486942][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.498159][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3020.531459][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.541093][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3020.555993][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.565797][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3020.580236][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.589413][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3020.604598][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.615034][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3020.629518][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.639015][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3020.651996][T23314] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3020.660695][T23314] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:45 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:45 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0xd04f00}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:45 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x40000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:45 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x3e8}]) 23:57:45 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, &(0x7f0000000040)="1bf821fd3a135bc697a7c219304e302069a86d7c86c409a04a4e98599d4173eb5761e64306", 0x25, 0x8005, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 3021.456248][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3021.464448][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3021.504629][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3021.512795][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3021.525373][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3021.533865][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3021.674038][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3021.682934][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3021.698083][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3021.707265][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3021.719585][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3021.727884][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3021.746527][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3021.755543][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3021.779317][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3021.788482][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3021.801800][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3021.810373][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3021.947112][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3021.958166][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3021.975544][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3021.984492][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3021.997866][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3022.007764][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3022.050925][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3022.062355][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3022.078909][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3022.089333][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3022.102438][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3022.112745][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3022.129063][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3022.138852][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3022.153731][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3022.163467][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3022.178634][T23331] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3022.187064][T23331] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:46 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:46 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0xf04a00}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:46 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x42000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:46 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000040), &(0x7f0000000080), 0x2, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x282400, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)=@getspdinfo={0x14, 0x25, 0x300, 0x70bd25, 0x25dfdbfc, 0x100, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0xc031) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0x5}, 0x20}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:57:46 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x402}]) [ 3022.816123][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3022.825084][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3022.867380][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3022.879210][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3022.891371][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3022.900512][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3023.037301][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.046301][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3023.061513][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.071344][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3023.084091][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.092333][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3023.111175][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.119899][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3023.142154][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.150788][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3023.163816][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.172654][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:47 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x1000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:47 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$INCFS_IOC_PERMIT_FILL(r0, 0x40046721, &(0x7f0000000040)={r0}) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 3023.301293][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.309925][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3023.331385][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.340014][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3023.353802][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.364235][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3023.396833][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.405909][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3023.418839][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.427334][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3023.439238][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.447541][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3023.460209][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.469053][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3023.483422][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.491679][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3023.504467][T23357] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3023.513079][T23357] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:47 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:47 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x4400, 0x0) umount2(&(0x7f0000000040)='./file0\x00', 0x3) perf_event_open(&(0x7f0000000180)={0x0, 0xffffffffffffffbe, 0x40, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x41282, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0xffffffffffffffff, 0x3, r1, 0x1) 23:57:47 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x406}]) 23:57:47 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x14ac000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:47 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x74030000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 3024.195222][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.204492][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3024.243042][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.252052][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3024.264815][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.273189][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3024.413512][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.422363][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3024.437609][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.446099][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3024.458623][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.468230][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3024.491377][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.501737][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3024.524462][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.533045][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3024.545776][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.554196][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3024.723484][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.731785][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3024.746013][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.754123][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3024.765844][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.774020][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3024.804538][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.813009][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3024.825030][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.836865][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3024.848979][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.857183][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3024.869950][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.878576][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3024.891036][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.899574][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3024.911115][T23372] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3024.919297][T23372] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:49 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:49 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x8a000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:49 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x408}]) 23:57:49 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x2000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:49 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_GET_STATION(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x311b3de6d2b4dee6, 0x70bd27, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x3, 0x10}}}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xac25}, @NL80211_ATTR_STA_FLAGS={0x24, 0x11, 0x0, 0x1, [@NL80211_STA_FLAG_WME={0x4}, @NL80211_STA_FLAG_AUTHENTICATED={0x4}, @NL80211_STA_FLAG_AUTHENTICATED={0x4}, @NL80211_STA_FLAG_WME={0x4}, @NL80211_STA_FLAG_WME={0x4}, @NL80211_STA_FLAG_SHORT_PREAMBLE={0x4}, @NL80211_STA_FLAG_TDLS_PEER={0x4}, @NL80211_STA_FLAG_AUTHORIZED={0x4}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x20000081) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}, 0x80}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) [ 3025.551644][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3025.559965][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3025.601012][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3025.609408][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3025.622063][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3025.630616][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3025.768490][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3025.777950][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3025.793490][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3025.803133][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3025.814924][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3025.823959][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3025.845691][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3025.854090][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3025.875860][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3025.884610][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3025.897059][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3025.905319][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:50 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x2040000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 3026.001817][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3026.010154][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3026.040423][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 23:57:50 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xf0000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:50 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x500}]) [ 3026.048842][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3026.063484][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3026.072745][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3026.144304][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3026.152522][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3026.165133][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3026.174417][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3026.186797][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3026.196905][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3026.210279][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3026.218411][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3026.231317][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3026.240549][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3026.253052][T23394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3026.261557][T23394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:50 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:50 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x4000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:50 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xf4ffffff}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:50 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x80803, 0x87) getsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000000240)=""/114, &(0x7f0000000200)=0x72) bind(r0, &(0x7f0000000340)=@in6={0xa, 0x4e23, 0x101, @remote, 0x38000000}, 0x80) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x28040) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x4000001, 0x10, r3, 0xd0309000) openat2$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000400)={0x2201, 0x8, 0x1}, 0x18) r4 = socket$inet6_udp(0xa, 0x2, 0x0) fsetxattr$trusted_overlay_redirect(r4, &(0x7f0000000440), &(0x7f0000000140)='./file0/file0\x00', 0xffffffffffffff18, 0x0) ioctl$BTRFS_IOC_LOGICAL_INO(r1, 0xc0389424, &(0x7f00000000c0)={0x0, 0x50, '\x00', 0x1, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) pipe(&(0x7f0000000300)) [ 3026.960680][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3026.969385][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3027.007070][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.015520][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3027.027663][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.036237][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3027.173955][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.182377][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3027.198047][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.206685][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3027.218933][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.227050][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3027.248446][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.256854][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3027.279208][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.287309][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3027.299720][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.307741][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3027.427272][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.435522][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3027.449989][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.458325][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3027.470490][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.478527][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3027.503923][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.512312][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3027.525067][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.533720][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3027.546422][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.555399][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3027.568163][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.576514][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3027.589701][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.598037][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3027.610163][T23412] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3027.618242][T23412] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:52 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x10, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$BTRFS_IOC_QUOTA_CTL(r1, 0xc0109428, &(0x7f0000000040)={0x2}) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_io_uring_setup(0x20a8, &(0x7f0000000080)={0x0, 0x2e2b, 0x20, 0x2, 0x15d}, &(0x7f000039d000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) 23:57:52 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x600}]) 23:57:52 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:52 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xfeffffff}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:52 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x6040000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 3028.262183][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.270705][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3028.307823][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.316024][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3028.328321][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.336818][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3028.475207][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.483567][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3028.498843][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.507779][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3028.520951][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.530115][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3028.549490][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.558110][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3028.579819][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.588212][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3028.600902][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.609198][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:52 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x7000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:52 executing program 2: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xe}]) 23:57:52 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xffffff7f}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 3028.739686][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.747873][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3028.763544][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.772159][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 23:57:52 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x604}]) [ 3028.790881][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.798969][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3028.834699][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.843574][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3028.856903][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.865391][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3028.877208][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.885711][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3028.898091][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.906315][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3028.919286][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.927302][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3028.939188][T23436] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3028.947288][T23436] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:53 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:53 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xfffffff4}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:53 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x9000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:53 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x700}]) [ 3029.666243][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3029.675127][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3029.712649][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3029.720856][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3029.732919][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3029.741308][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3029.882890][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3029.893501][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3029.910133][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3029.919702][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3029.934055][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3029.943659][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3029.963976][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3029.973384][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3029.996818][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3030.006079][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3030.019348][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3030.028096][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3030.190229][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3030.198617][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3030.213733][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3030.222199][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3030.235181][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3030.243694][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3030.275172][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3030.283659][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3030.296048][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3030.304213][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3030.316073][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3030.324553][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3030.337119][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3030.345381][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3030.358669][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3030.367331][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3030.379912][T23450] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3030.388589][T23450] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:54 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:54 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0xf000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:54 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xfffffffe}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:54 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x804}]) 23:57:54 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 3031.008759][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.017373][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3031.054734][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.062997][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3031.074886][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.083123][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3031.220336][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.228521][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3031.243803][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.251948][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3031.263802][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.271830][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3031.290206][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.298247][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3031.319835][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.328305][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3031.341219][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.349607][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:55 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x10000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:55 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:55 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0xffffffff}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:55 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x809}]) [ 3031.493061][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.502848][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3031.523263][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.533077][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3031.546225][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.555186][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3031.584531][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.592541][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3031.605166][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.613281][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3031.625220][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.633532][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3031.646235][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.654428][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3031.666942][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.675077][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3031.686778][T23477] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3031.695077][T23477] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:56 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:56 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x80a}]) 23:57:56 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:56 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x76030000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 3032.398875][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3032.407190][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3032.443594][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3032.452082][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3032.464498][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3032.473174][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3032.608279][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3032.616830][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3032.631143][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3032.639641][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3032.653857][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3032.663281][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3032.684126][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3032.694400][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3032.716801][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3032.725697][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3032.738540][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3032.747056][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3032.955800][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3032.964710][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3032.980336][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3032.988836][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3033.001114][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3033.010308][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3033.032087][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3033.040480][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3033.053382][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3033.061881][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3033.074700][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3033.083678][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3033.097577][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3033.106302][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3033.119956][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3033.129200][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3033.142120][T23489] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3033.151293][T23489] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:57 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x7f000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:57 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8cffffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:57 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x900}]) 23:57:57 executing program 2: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xc}]) 23:57:57 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 3033.772504][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3033.781193][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3033.819091][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3033.830494][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3033.842901][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3033.851645][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3033.988737][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3033.997567][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3034.013264][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3034.022079][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3034.034812][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3034.043017][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3034.061434][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3034.070394][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3034.093746][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3034.102269][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3034.114261][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3034.122902][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:58 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x88000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:58 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xce02000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 3034.326115][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3034.334867][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3034.350368][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3034.359371][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3034.374797][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3034.384651][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3034.415667][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3034.425658][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3034.439199][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3034.448963][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3034.464775][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3034.475640][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3034.492410][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3034.502213][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3034.515952][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 23:57:58 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x908}]) [ 3034.524619][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3034.537268][T23521] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3034.546150][T23521] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:57:58 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:58 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xe203000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:58 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0xff600000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:58 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xa00}]) 23:57:58 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:58 executing program 2: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x7f00}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:59 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0xffffffff}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:57:59 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xa08}]) 23:57:59 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xec03000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:59 executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xd00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:57:59 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x4}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:57:59 executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xd00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 3035.686442][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3035.694964][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3035.733684][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3035.742227][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3035.755170][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3035.763503][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3035.906244][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3035.914783][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3035.929952][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3035.938569][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3035.950493][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3035.958803][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3035.977427][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3035.985737][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3036.008636][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3036.017075][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3036.029334][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3036.037363][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3036.081753][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3036.090153][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3036.104186][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3036.113186][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3036.125005][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3036.133451][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3036.155653][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3036.164165][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3036.176593][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3036.184808][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3036.196702][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3036.205848][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3036.218692][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3036.226730][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3036.239374][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3036.247650][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3036.259541][T23557] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3036.267850][T23557] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:00 executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xd00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:00 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xc00}]) 23:58:00 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x7}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:00 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:00 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xf6ffffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:00 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:00 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x2}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:00 executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:00 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfeffffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:00 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x8}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:00 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xd00}]) 23:58:00 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xffffff7f00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:00 executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 3037.295792][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.304270][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3037.344495][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.352749][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3037.364704][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.373033][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3037.509242][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.517668][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3037.532799][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.541446][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3037.553222][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.561932][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3037.581565][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.589707][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3037.612625][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.620941][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3037.634663][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.642926][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3037.693532][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.702052][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3037.715641][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.723649][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3037.735535][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.743628][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3037.766243][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.774948][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3037.788086][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.796923][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3037.810478][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.818815][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3037.834205][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.843292][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3037.856484][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.868406][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3037.882186][T23593] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3037.891982][T23593] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:02 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:02 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x9}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:02 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x4}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:02 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xffffffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:02 executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:02 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xe00}]) 23:58:02 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x1200}]) 23:58:02 executing program 2: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x376}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:02 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:02 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x7}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:02 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:02 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x9}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:02 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x2000}]) [ 3038.934816][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3038.943377][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3038.982336][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3038.991628][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3039.003596][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.011724][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3039.157598][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.165858][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3039.182286][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.190409][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3039.202632][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.211159][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3039.232448][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.240922][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3039.266046][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.274372][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3039.286306][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.295228][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3039.367958][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.376962][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3039.394335][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.402578][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3039.415156][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.423451][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3039.447704][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.456667][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3039.469054][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.477824][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3039.495562][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.504018][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3039.516482][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.525003][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3039.538425][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.546830][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3039.559585][T23633] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3039.567835][T23633] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:03 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:03 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0xf}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:03 executing program 2: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x376}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:03 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x3f00}]) 23:58:03 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xa}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:03 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:03 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x10}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:03 executing program 2: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x376}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:04 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x4000}]) 23:58:04 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x88}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:04 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x204}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:04 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xf}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 3040.379119][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.387785][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3040.405530][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.414217][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3040.426613][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.435199][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3040.476128][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.485268][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3040.497540][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.505704][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3040.518411][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.527119][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3040.540169][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.548557][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3040.561552][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.570160][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3040.582003][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.590222][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3040.636479][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.645078][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3040.658172][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.666659][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3040.678844][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.687548][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3040.703406][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.711527][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3040.723871][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.732213][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3040.744188][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.752503][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3040.764608][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.773277][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3040.785525][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.794293][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3040.806387][T23675] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3040.814528][T23675] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:05 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:05 executing program 2: syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x376}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:05 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x60ff}]) 23:58:05 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x376}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:05 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x21}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:05 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:05 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x402}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:05 executing program 2: syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x376}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:05 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x406}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:05 executing program 2: syz_io_uring_setup(0x0, &(0x7f0000000080)={0x0, 0x376}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:05 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x6300}]) 23:58:05 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x42}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:05 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x604}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 3041.615648][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.624679][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3041.643400][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.652004][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3041.665171][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.675161][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3041.708995][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.717549][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3041.730123][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.738727][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3041.750514][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.758887][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3041.772162][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.780370][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3041.793555][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.801727][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3041.813996][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.822118][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3041.872192][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.880720][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3041.896519][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.906378][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3041.919423][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.928065][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3041.943676][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.952535][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3041.965550][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.973744][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3041.985496][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3041.993893][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3042.006008][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3042.014192][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3042.026584][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3042.034825][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3042.047373][T23710] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3042.056133][T23710] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:06 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:06 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x8008}]) 23:58:06 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:06 executing program 2: syz_io_uring_setup(0x6b67, 0x0, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:06 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x8a}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:06 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x700}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:06 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x900}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:06 executing program 2: syz_io_uring_setup(0x6b67, 0x0, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:06 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0xf00}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:06 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x8102}]) 23:58:06 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xf0}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:06 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x2000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:06 executing program 2: syz_io_uring_setup(0x6b67, 0x0, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 3042.800370][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3042.808885][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3042.825409][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3042.836647][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3042.850130][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3042.859040][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3042.899704][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3042.908360][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3042.920781][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3042.929186][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3042.941010][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3042.949089][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3042.961764][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3042.970085][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3042.983648][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3042.991760][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3043.003427][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3043.011824][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3043.053671][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3043.067907][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3043.082024][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3043.090592][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3043.102515][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3043.110750][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3043.126214][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3043.134316][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3043.146409][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3043.154588][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3043.167154][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3043.175293][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3043.187172][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3043.195470][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3043.207584][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3043.216079][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3043.227979][T23746] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3043.236142][T23746] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:07 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x4000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:07 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xfe}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:07 executing program 2: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:07 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:07 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x8200}]) 23:58:07 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:07 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x5500}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:07 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x60ff}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:07 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x9700}]) 23:58:07 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x204}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:07 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x7603}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:07 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x21}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 3043.985612][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3043.994978][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3044.012955][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.021966][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3044.034388][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.042900][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3044.082080][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.090287][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3044.103243][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.111275][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3044.123392][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.131695][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3044.144945][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.153474][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3044.166566][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.174980][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3044.187353][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.195489][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3044.238316][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.246585][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3044.259183][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.268091][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3044.280020][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.288528][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3044.305150][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.313444][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3044.325730][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.333854][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3044.345858][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.354031][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3044.366098][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.374495][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3044.387080][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.396209][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3044.409847][T23790] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3044.419846][T23790] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:08 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:08 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xe803}]) 23:58:08 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x7f00}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:08 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:08 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x21}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:08 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x374}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:08 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x8800}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:08 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x9700}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:08 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xefff}]) 23:58:08 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x21}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:09 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x402}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:09 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x104000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 3045.230635][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.239779][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3045.256563][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.265069][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3045.276662][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.284985][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3045.324184][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.332469][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3045.345295][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.353623][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3045.368742][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.380002][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3045.393336][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.401656][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3045.414537][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.423177][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3045.435472][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.443536][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3045.484654][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.492920][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3045.506787][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.516136][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3045.528423][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.537158][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3045.552720][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.561324][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3045.573560][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.582040][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3045.594354][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.602932][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3045.615508][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.623918][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3045.636537][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.644877][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3045.656927][T23824] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3045.665639][T23824] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:09 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xf600}]) 23:58:09 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:09 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:09 executing program 2: syz_io_uring_setup(0x0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x21}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:09 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x406}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:09 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x105400}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:09 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x200000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:10 executing program 2: syz_io_uring_setup(0x0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x21}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:10 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x400000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:10 executing program 2: syz_io_uring_setup(0x0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x21}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:10 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xfe00}]) 23:58:10 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x604}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:10 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x401000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 3046.686563][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3046.695236][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3046.736283][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3046.744587][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3046.756936][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3046.765483][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3046.909495][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3046.917591][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3046.932630][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3046.940902][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3046.953398][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3046.961428][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3046.981404][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3046.989442][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3047.011215][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3047.019670][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3047.032946][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3047.041075][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3047.093600][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3047.101914][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3047.115451][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3047.124022][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3047.136291][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3047.144581][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3047.165860][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3047.174296][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3047.186160][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3047.194636][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3047.206884][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3047.215222][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3047.227847][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3047.236135][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3047.248589][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3047.256786][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3047.268444][T23862] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3047.276686][T23862] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:11 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x900, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:11 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x4af000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:11 executing program 2: syz_io_uring_setup(0x75cf, 0x0, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:11 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:11 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xff00}]) 23:58:11 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x700}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:11 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x4fd000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:11 executing program 2: syz_io_uring_setup(0x75cf, 0x0, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:11 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:11 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x541000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:11 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xff01}]) 23:58:11 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x900}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:11 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x550000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:11 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xff07}]) 23:58:11 executing program 2: syz_io_uring_setup(0x75cf, 0x0, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:11 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xb00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 3048.254827][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.263659][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3048.302664][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.311028][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3048.322849][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.331225][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3048.478630][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.486817][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3048.500699][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.509054][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3048.522007][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.530114][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3048.548388][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.556637][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3048.579811][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.588649][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3048.600756][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.609365][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3048.825491][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.835176][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3048.850249][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.859001][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3048.871325][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.880163][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3048.901389][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.910516][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3048.922830][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.931794][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3048.944134][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.952262][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3048.965623][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.974437][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3048.987090][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3048.995481][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3049.008683][T23902] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3049.017317][T23902] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:13 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:13 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xff0f}]) 23:58:13 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:13 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:13 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xa00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:13 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x970000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:13 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0xc04a01}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:13 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xd00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:13 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, 0x0, &(0x7f0000000000)) 23:58:13 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0xd04f00}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:13 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xffef}]) 23:58:13 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:13 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xf00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 3049.682014][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3049.690910][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3049.708621][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3049.716680][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3049.728444][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3049.736460][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3049.776397][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3049.785003][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3049.797231][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3049.805375][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3049.817775][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3049.828284][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3049.842351][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3049.851976][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3049.866716][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3049.876270][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3049.895165][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3049.904004][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3049.948974][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3049.957346][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3049.970493][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3049.978694][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3049.990779][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3049.999153][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3050.017809][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3050.026469][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3050.038660][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3050.047023][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3050.059130][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3050.067750][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3050.079677][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3050.088067][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3050.100876][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3050.109114][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3050.121386][T23966] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3050.131418][T23966] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:14 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:14 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x1100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:14 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0xf04a00}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:14 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, 0x0, &(0x7f0000000000)) 23:58:14 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:14 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x20000}]) 23:58:14 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x1000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:14 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x1200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:14 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x40000}]) 23:58:14 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, 0x0, &(0x7f0000000000)) 23:58:14 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2100}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:14 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x14ac000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:14 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 3051.128712][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.137734][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3051.180168][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.188400][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3051.200289][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.208479][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3051.349321][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.357336][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3051.372083][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.380502][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3051.392184][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.400316][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3051.418669][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.427365][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3051.449743][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.457972][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3051.470863][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.480045][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3051.548391][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.556724][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3051.570659][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.579974][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3051.593414][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.601613][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3051.623198][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.632240][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3051.644398][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.652980][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3051.664848][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.673124][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3051.685849][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.694149][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3051.706859][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.714973][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3051.734396][T24005] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3051.742547][T24005] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:16 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x70800}]) 23:58:16 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:16 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:16 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x3f00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:16 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x2000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:16 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), 0x0) 23:58:16 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x2040000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:16 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x4000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:16 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:16 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x6040000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:16 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x4000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:16 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x70809}]) 23:58:16 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), 0x0) [ 3052.466791][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.475281][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3052.492177][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.500906][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3052.512682][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.520937][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3052.561373][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.569640][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3052.582207][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.590343][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3052.602060][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.610504][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3052.623102][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.631236][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3052.645136][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.653275][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3052.665298][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.673441][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3052.716781][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.725441][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3052.737856][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.746063][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3052.758434][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.766627][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3052.781786][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.789886][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3052.801438][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.809743][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3052.821643][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.831764][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3052.844696][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.853270][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3052.866238][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.876439][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3052.890128][T24068] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3052.899924][T24068] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:17 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x4200}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:17 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x7000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:17 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:17 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:17 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x9000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:17 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), 0x0) 23:58:17 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x7080a}]) 23:58:17 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0xf000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:17 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:17 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x10000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:17 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x80000}]) 23:58:17 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x7403}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:17 executing program 2: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xffef}]) 23:58:17 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x76030000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:17 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xf00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 3053.744545][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3053.754512][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3053.772239][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3053.781689][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3053.793856][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3053.802187][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3053.845146][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3053.854117][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3053.867794][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3053.879522][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3053.891791][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3053.901431][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3053.915735][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3053.924963][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3053.940201][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3053.950336][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3053.964014][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3053.973869][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3054.030641][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3054.040149][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3054.057220][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3054.066927][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3054.083531][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3054.092954][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3054.127062][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3054.136086][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3054.150385][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3054.159180][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3054.176628][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3054.185984][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3054.200604][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3054.209634][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3054.223660][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3054.232064][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3054.245682][T24106] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3054.253955][T24106] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:18 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x80700}]) 23:58:18 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:18 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:18 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x8a00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:18 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x7f000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:18 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xf00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:18 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x88000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:18 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:18 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x100000}]) 23:58:18 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xf00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:18 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xfeff}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:18 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0xff600000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:18 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x100020}]) [ 3055.463013][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.471289][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3055.511326][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.519683][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3055.531465][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.540045][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3055.675661][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.684257][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3055.699516][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.708958][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3055.721761][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.730336][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3055.751008][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.759538][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3055.782795][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.792123][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3055.804178][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.812595][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3055.878564][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.887329][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3055.901253][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.910292][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3055.922588][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.931036][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3055.951770][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.960868][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3055.973391][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3055.981629][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3055.993527][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3056.001620][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3056.014054][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3056.022599][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3056.035087][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3056.043909][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3056.055781][T24153] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3056.064357][T24153] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:20 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x400001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:20 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xfffe}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:20 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0xffffffff}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:20 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:20 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:20 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x104000}]) 23:58:20 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:20 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:20 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:20 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x40000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:20 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x105400}]) 23:58:20 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 3056.820155][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3056.834090][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3056.851484][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3056.859607][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3056.872798][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3056.881751][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3056.923746][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3056.933370][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3056.946373][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3056.954972][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3056.969358][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3056.978004][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3056.991296][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3056.999702][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3057.013995][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3057.022482][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3057.036759][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3057.045716][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3057.089464][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3057.098788][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3057.112158][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3057.120426][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3057.133212][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3057.141540][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3057.156753][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3057.165143][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3057.177490][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3057.186592][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3057.198379][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3057.206979][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3057.219338][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3057.227865][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3057.240584][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3057.248873][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3057.260568][T24195] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3057.268792][T24195] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:21 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:21 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x400000}]) 23:58:21 executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:21 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:21 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:21 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x401000}]) 23:58:21 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:21 executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:21 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x7}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:21 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x4af000}]) 23:58:21 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:21 executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:22 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x9}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:22 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:22 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xf}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 3058.175141][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.183766][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3058.202706][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.211697][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3058.223362][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.232021][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3058.266860][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.275538][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3058.289714][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.298431][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3058.310922][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.319516][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3058.332661][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.341097][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3058.354314][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.362610][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3058.375225][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.383516][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3058.434433][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.442735][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3058.455625][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.464025][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3058.476141][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.485586][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3058.502049][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.510255][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3058.523534][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.531867][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3058.543527][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.552694][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3058.566827][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.575132][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3058.589037][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.597882][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3058.610102][T24238] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3058.618466][T24238] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:22 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x1004000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:23 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2040000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:23 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x10}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:22 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x9}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:22 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x4fd000}]) [ 3059.253219][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.261765][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3059.301130][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.310034][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3059.322473][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.332045][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3059.471302][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.479508][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3059.494154][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.502618][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3059.514392][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.522851][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3059.542015][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.550552][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3059.572257][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.580598][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3059.592958][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.601530][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:23 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x88}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:23 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:23 executing program 2: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x7}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 3059.759208][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.767944][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3059.789096][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 23:58:24 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x6040000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:24 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x541000}]) [ 3059.798481][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3059.811293][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.820089][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3059.861606][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.870137][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3059.882371][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.890662][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3059.903446][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.912041][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3059.927600][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.935760][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3059.949046][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.957508][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3059.969528][T24264] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3059.978258][T24264] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:24 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:24 executing program 2: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x4}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:24 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:24 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x800000}]) 23:58:24 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:24 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x204}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:24 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x376}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:24 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:24 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x7000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:24 executing program 2: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x10}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:24 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x402}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:24 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x820000}]) 23:58:24 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:24 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x406}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 3060.795059][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3060.804442][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3060.822371][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3060.832546][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3060.845071][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3060.854042][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3060.892838][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3060.901569][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3060.914215][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3060.923096][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3060.935496][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3060.945456][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3060.958506][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3060.966727][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3060.979304][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3060.987540][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3060.999235][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3061.007316][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3061.053091][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3061.061372][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3061.076120][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3061.084725][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3061.097516][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3061.106400][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3061.125318][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3061.134488][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3061.146867][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3061.155990][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3061.169045][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3061.177423][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3061.190066][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3061.198562][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3061.211254][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3061.219370][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3061.231929][T24315] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3061.240189][T24315] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:25 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x604}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:25 executing program 2 (fault-call:0 fault-nth:0): syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:25 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:25 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:25 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x8000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:25 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x970000}]) 23:58:25 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x700}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:25 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:25 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x900}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:25 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:25 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xc04a01}]) 23:58:25 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xf00}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 3062.299855][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.308572][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3062.348453][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.357302][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3062.369757][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.378717][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3062.516567][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.526172][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3062.542044][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.550873][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3062.562771][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.571409][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3062.592373][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.600626][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3062.622981][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.631278][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3062.643617][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.651940][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3062.712038][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.720582][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3062.734811][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.743103][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3062.754946][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.763745][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3062.785241][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.794331][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3062.806949][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.815141][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3062.829900][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.839451][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3062.854931][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.864572][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3062.878368][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.886910][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3062.899259][T24355] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3062.907673][T24355] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:27 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:27 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:27 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x9000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:27 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x9000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:27 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xd04f00}]) 23:58:27 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300), &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:27 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:27 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xf04a00}]) 23:58:27 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:27 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x2}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:27 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xa000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:27 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xb000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:27 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x5500}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:27 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x3}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:27 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x1000000}]) [ 3064.079940][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.088668][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3064.127615][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.135648][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3064.147757][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.156042][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3064.292825][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.303201][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3064.318629][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.327336][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3064.339175][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.348390][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3064.372140][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.380285][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3064.403673][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.412079][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3064.425256][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.433964][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3064.488762][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.497170][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3064.511069][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.519940][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3064.532423][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.540830][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3064.562599][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.571239][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3064.583314][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.591433][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3064.604247][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.612706][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3064.625787][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.634297][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3064.647072][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.655438][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3064.667833][T24394] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3064.676218][T24394] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:28 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:28 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xf000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:28 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x14ac000}]) 23:58:28 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x4}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:28 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x60ff}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:28 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xc000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:28 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x7603}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:29 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xd000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:29 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x7}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:29 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x7f00}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:29 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x180ffff}]) 23:58:29 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:29 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x20000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 3065.146199][T24472] ================================================================== [ 3065.154749][T24472] BUG: KCSAN: data-race in compact_zone / compact_zone [ 3065.161876][T24472] [ 3065.164380][T24472] write to 0xffff88823fffad90 of 8 bytes by task 24466 on cpu 0: [ 3065.172271][T24472] compact_zone+0x1496/0x1d30 [ 3065.177050][T24472] try_to_compact_pages+0x317/0x850 [ 3065.182251][T24472] __alloc_pages_direct_compact+0x61/0x330 [ 3065.188139][T24472] __alloc_pages_slowpath+0x5d4/0xb70 [ 3065.193596][T24472] __alloc_pages+0x25e/0x320 [ 3065.198377][T24472] alloc_pages+0x21d/0x310 [ 3065.203126][T24472] __get_free_pages+0x8/0x30 [ 3065.207944][T24472] io_uring_create+0x887/0x18d0 [ 3065.212994][T24472] __x64_sys_io_uring_setup+0xe1/0x120 [ 3065.218661][T24472] do_syscall_64+0x4a/0x90 [ 3065.223565][T24472] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3065.229984][T24472] [ 3065.232303][T24472] read to 0xffff88823fffad90 of 8 bytes by task 24472 on cpu 1: [ 3065.240415][T24472] compact_zone+0x1472/0x1d30 [ 3065.245845][T24472] try_to_compact_pages+0x317/0x850 [ 3065.251310][T24472] __alloc_pages_direct_compact+0x61/0x330 [ 3065.257353][T24472] __alloc_pages_slowpath+0x5d4/0xb70 [ 3065.263045][T24472] __alloc_pages+0x25e/0x320 [ 3065.267738][T24472] alloc_pages+0x21d/0x310 [ 3065.272142][T24472] __get_free_pages+0x8/0x30 [ 3065.276717][T24472] io_uring_create+0x887/0x18d0 [ 3065.281713][T24472] __x64_sys_io_uring_setup+0xe1/0x120 [ 3065.287173][T24472] do_syscall_64+0x4a/0x90 [ 3065.291580][T24472] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3065.297999][T24472] [ 3065.300406][T24472] Reported by Kernel Concurrency Sanitizer on: [ 3065.306696][T24472] CPU: 1 PID: 24472 Comm: syz-executor.2 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 3065.317094][T24472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3065.327234][T24472] ================================================================== [ 3065.528850][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.536993][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3065.554100][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.562405][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3065.574998][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.583311][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3065.642540][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.650841][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3065.664009][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.672719][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3065.684786][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.695090][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3065.707955][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.716176][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3065.729699][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.738241][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3065.751329][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.759948][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3065.802725][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.810958][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3065.826244][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.835496][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3065.848168][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.856634][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3065.872978][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.882054][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3065.894946][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.904808][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3065.918690][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.927711][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3065.940961][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.950651][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3065.963612][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.972341][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3065.985858][T24439] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3065.994677][T24439] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:30 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8800}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:30 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x2000000}]) 23:58:30 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:30 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x21000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:30 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x8}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:30 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:30 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x9700}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:30 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x11000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:30 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x2040000}]) 23:58:30 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x9}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:30 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x104000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:30 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x3000000}]) 23:58:30 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x12000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 3067.222160][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.230732][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3067.271071][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.279664][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3067.292731][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.301909][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3067.436695][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.445976][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3067.461531][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.471904][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3067.484237][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.492857][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3067.510982][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.519513][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3067.542925][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.552396][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3067.566616][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.575665][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3067.642195][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.651428][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3067.665213][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.673663][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3067.685294][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.693438][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3067.713598][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.724501][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3067.737965][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.747076][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3067.759309][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.769585][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3067.783805][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.792795][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3067.807858][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.816920][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3067.833020][T24484] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3067.843887][T24484] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:32 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x105400}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:32 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xf}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:32 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:32 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x3f000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:32 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x4000000}]) 23:58:32 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:32 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x200000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:32 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x5000000}]) 23:58:32 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x1e}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:32 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x27000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:32 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x40000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:32 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x6000000}]) 23:58:32 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x400000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) [ 3068.749086][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3068.757218][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3068.773991][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3068.782664][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3068.794547][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3068.803354][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3068.836901][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3068.845499][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3068.858999][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3068.867590][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3068.880301][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3068.889068][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3068.902342][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3068.911474][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3068.925224][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3068.933819][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3068.946976][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3068.955795][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3069.003093][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3069.012028][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3069.026554][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3069.035728][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3069.049677][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3069.063498][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3069.081034][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3069.089717][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3069.101766][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3069.109910][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3069.121884][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3069.130554][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3069.142605][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3069.150760][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3069.162827][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3069.171593][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3069.183647][T24532] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3069.192057][T24532] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:33 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x88}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:33 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x401000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:33 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x42000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:33 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x6040000}]) 23:58:33 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:33 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:33 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4af000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:33 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:33 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xfe}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:33 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x7000000}]) 23:58:33 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4fd000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:33 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x204}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:33 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 3070.247230][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.256802][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3070.297366][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.305820][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3070.317494][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.325995][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3070.466068][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.474812][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3070.489856][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.498614][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3070.511261][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.519846][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3070.538644][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.547615][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3070.569520][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.577753][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3070.590053][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.598351][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3070.663033][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.671594][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3070.685268][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.693817][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3070.705688][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.713835][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3070.735556][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.744031][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3070.756385][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.764580][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3070.776359][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.784380][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3070.796647][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.804846][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3070.816964][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.826826][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3070.838811][T24572] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3070.846961][T24572] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:35 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:35 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x74030000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:35 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x8000000}]) 23:58:35 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x300}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:35 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x541000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:35 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:35 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x550000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:35 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:35 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x376}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:35 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x8040000}]) 23:58:35 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x8a000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:35 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x970000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:35 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:35 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x8800000}]) 23:58:35 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x402}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 3071.812429][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3071.821506][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3071.865168][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3071.873862][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3071.887196][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3071.896216][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3072.039200][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.048123][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3072.063602][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.073728][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3072.087442][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.097283][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3072.117474][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.126075][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3072.148633][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.157145][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3072.170238][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.178580][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:36 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xc04a01}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:36 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x9000000}]) [ 3072.413353][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.422106][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3072.435909][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.444392][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3072.456403][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.464766][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3072.495858][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.504446][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3072.516694][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.524731][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3072.536373][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.544570][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3072.556622][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.564642][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3072.577245][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.585980][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3072.598201][T24614] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3072.606624][T24614] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:37 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xf0000000}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:37 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:37 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x9080000}]) 23:58:37 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x406}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:37 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xd04f00}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:37 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:37 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xf04a00}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:37 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x604}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:37 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x8cffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:37 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0x9080700}]) 23:58:37 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:37 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x700}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:37 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xf4ffffff}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) [ 3073.245479][T24696] ================================================================== [ 3073.253861][T24696] BUG: KCSAN: data-race in compact_zone / compact_zone [ 3073.260921][T24696] [ 3073.263401][T24696] write to 0xffff88823fffad90 of 8 bytes by task 24698 on cpu 1: [ 3073.272025][T24696] compact_zone+0x1496/0x1d30 [ 3073.276881][T24696] try_to_compact_pages+0x317/0x850 [ 3073.282258][T24696] __alloc_pages_direct_compact+0x61/0x330 [ 3073.288439][T24696] __alloc_pages_slowpath+0x5d4/0xb70 [ 3073.293920][T24696] __alloc_pages+0x25e/0x320 [ 3073.299090][T24696] alloc_pages+0x21d/0x310 [ 3073.303511][T24696] __get_free_pages+0x8/0x30 [ 3073.308124][T24696] io_uring_create+0x9b9/0x18d0 [ 3073.313170][T24696] __x64_sys_io_uring_setup+0xe1/0x120 [ 3073.318619][T24696] do_syscall_64+0x4a/0x90 [ 3073.323042][T24696] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3073.329065][T24696] [ 3073.331387][T24696] read to 0xffff88823fffad90 of 8 bytes by task 24696 on cpu 0: [ 3073.338999][T24696] compact_zone+0x1472/0x1d30 [ 3073.343841][T24696] try_to_compact_pages+0x317/0x850 [ 3073.349127][T24696] __alloc_pages_direct_compact+0x61/0x330 [ 3073.355145][T24696] __alloc_pages_slowpath+0x29a/0xb70 [ 3073.360635][T24696] __alloc_pages+0x25e/0x320 [ 3073.365437][T24696] alloc_pages+0x21d/0x310 [ 3073.369956][T24696] __get_free_pages+0x8/0x30 [ 3073.374665][T24696] io_uring_create+0x9b9/0x18d0 [ 3073.379602][T24696] __x64_sys_io_uring_setup+0xe1/0x120 [ 3073.385577][T24696] do_syscall_64+0x4a/0x90 [ 3073.390171][T24696] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3073.396188][T24696] [ 3073.399011][T24696] Reported by Kernel Concurrency Sanitizer on: [ 3073.405610][T24696] CPU: 0 PID: 24696 Comm: syz-executor.0 Tainted: G W 5.13.0-rc1-syzkaller #0 [ 3073.417167][T24696] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3073.428134][T24696] ================================================================== [ 3073.671807][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3073.680503][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3073.698443][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3073.707904][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3073.721151][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3073.731303][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3073.772836][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3073.782171][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3073.796356][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3073.806029][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3073.819009][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3073.830696][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3073.843820][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3073.852767][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3073.866748][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3073.875670][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3073.888484][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3073.896806][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3073.945941][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3073.954368][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3073.967216][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3073.975768][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3073.987862][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3073.996207][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3074.012642][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3074.020864][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3074.033617][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3074.041856][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3074.057112][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3074.065721][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3074.078860][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3074.089084][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3074.103220][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3074.112758][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3074.125318][T24667] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3074.133384][T24667] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 23:58:38 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xf6ffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:38 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xa000000}]) 23:58:38 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x14ac000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:38 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:38 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x900}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:38 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xfeffffff}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:38 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:38 executing program 0: syz_io_uring_setup(0x6b67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2040000}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0) 23:58:38 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfeffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 23:58:38 executing program 3: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1800007, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r3, 0x8200) io_submit(r2, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe8030000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x1a000000, 0xa080000}]) 23:58:38 executing program 2: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0xf00}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:38 executing program 1: syz_io_uring_setup(0x75cf, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xffffff7f}, &(0x7f00003b2000/0x1000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000000)) 23:58:38 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xffffff7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x6c00}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 3074.830781][T24709] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3074.839555][T24709] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3074.856373][T24709] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3074.864394][T24709] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3074.876045][T24709] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3074.884817][T24709] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3074.927047][T24709] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3074.935465][T24709] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000085bcc145 [ 3074.947487][T24709] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3074.956337][T24709] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000011d3af3e [ 3074.968850][T24709] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3074.976936][T24709] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000f9dc9fd9 [ 3074.989708][T24709] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3074.997828][T24709] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000e54bc02d [ 3075.011669][T24709] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3075.019821][T24709] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000098e6eeea [ 3075.031928][T24709] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3075.040270][T24709] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000092ea8c19 [ 3075.092449][T24709] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3075.100867][T24709] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x00000000cf530159 [ 3075.127202][T24709] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3075.135254][T24709] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x0000000082aafb15 [ 3075.147870][T24709] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1 [ 3075.156328][T24709] ref_ctr decrement failed for inode: 0x361f offset: 0x6c00 ref_ctr_offset: 0x8 of mm: 0x000000001d122745 [ 3075.173037][T24709] ref_ctr going negative. vaddr: 0x20000008, curr val: 0, delta: -1